Checklist · Delivery

Web application security before launch

Application-level checks for login, sessions, authorization, input handling and headers.

Owner: Application developers and a reviewerTime: 2 hours

0 of 24

Login and sessions

Passwords are hashed with Argon2id, scrypt or bcrypt; never encrypted or hashed with a fast hash.
Login, password reset and MFA endpoints are rate-limited, and failed attempts are logged.
Password-reset tokens are random, single-use, short-lived, and the reply does not reveal whether the account exists.
Session cookies are HttpOnly, Secure and SameSite, and the session ID changes after login.
Logout invalidates the session on the server, and idle and absolute timeouts exist.
State-changing requests are protected against CSRF.

Every endpoint checks permissions on the server; the interface hiding a button is not a control.
Object access is checked against the caller, so changing an ID in a URL returns another user's data only if allowed (no IDOR).
Fields a client may set are listed; extra fields in a request are ignored (no mass assignment).
Admin and internal routes are not reachable from the public side.

All database access uses parameterised queries or an ORM; no string-built SQL.
Output is encoded for its context, and a Content-Security-Policy is set.
Server-side fetching of user-supplied URLs blocks internal addresses and cloud metadata endpoints (SSRF).
Uploads are checked for type and size, stored outside the web root with generated names, and served with a safe content type.
Redirect targets are validated against an allow-list.
Errors show a generic message to users; stack traces and SQL stay in the logs.

HTTPS only, with HSTS; HTTP redirects and the certificate chain are valid.
X-Content-Type-Options, frame-ancestors (or X-Frame-Options) and a Referrer-Policy are set.
CORS lists specific origins; it never combines a wildcard with credentials.
API list endpoints are paginated with a maximum page size, and request bodies have a size limit.
Debug pages, sample data, default accounts and directory listings are removed from the release.

Dependency, static and secret scans are clean or have recorded exceptions.
An authenticated scan or manual test was run against a production-like environment and its findings triaged.
Login, access-denied and admin actions are logged with user and time, without storing passwords or tokens.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.