SQL Injections | Avoid Dynamic Code executions, Prevent the usage of serialization, perform dependency scanning
Cross-Site Scripting | Prevention from Malicious Code, the usage of Anti CSRF tokens, and User’s Data encoding on the output.
Client / Server Side Validations | Both the Client and Server Side Validations are necessary to avoid any chances of wrong input or intervention of a Malicious Code
Generic / Pre Defined Errors | Generic & Precise. The error messages should only contain the general information necessary for the end-user.
Password Checks | Password Checks Algorithms, Timely Password Change Policy, Password Encryption, and Hashing Methods
SSL Security Layer | SSL security certificates will be implemented, all the webpages and elements will be HTTPS protected.
Restrict File
Uploads | Users won’t be able to upload any kind of file.
Authentication | Firebase Auth, OAuth, 2FA Authentication, Limit Failed Login attempts.
Limit Payload Size | The size of incoming requests and configuring body-parser will be limited.
Avoid Data Leaks | Send only needed information, Control everything that is to be shown on the screen.
Logging | Maintain Proper Logs and Metrics