Web Security Cheat Sheet

// pg (PostgreSQL)
const result = await pool.query(
  'SELECT * FROM users WHERE email = $1', [email]
);
// mysql2
const [rows] = await conn.execute(
  'SELECT * FROM users WHERE id = ?', [userId]
);

# psycopg2
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))
# SQLAlchemy ORM (safe by default)
user = session.query(User).filter_by(email=email).first()

PreparedStatement ps = conn.prepareStatement(
  "SELECT * FROM users WHERE email = ?");
ps.setString(1, email);
ResultSet rs = ps.executeQuery();

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);

// Encode for HTML context
function escapeHtml(str) {
  return str.replace(/&/g,'&').replace(//g,'>').replace(/"/g,'"');
}
// Use textContent instead of innerHTML
el.textContent = userInput; // Safe
el.innerHTML = userInput;   // DANGEROUS

Content-Security-Policy:
  default-src 'self';
  script-src 'self';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  connect-src 'self';
  frame-ancestors 'none';

import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(dirtyHtml);
// With config
const clean = DOMPurify.sanitize(dirty, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
  ALLOWED_ATTR: ['href']
});

<!-- Server generates unique token per session -->
<form method="POST" action="/transfer">
  <input type="hidden" name="_csrf" value="a1b2c3...">
  ...
</form>
// Express: csurf middleware (or csrf-csrf)
app.use(csrfProtection);
res.render('form', { csrfToken: req.csrfToken() });

Set-Cookie: session=abc123;
  SameSite=Strict;  // Best: no cross-site sending
  Secure;           // HTTPS only
  HttpOnly;         // No JS access
  Path=/;
  Max-Age=3600

// 1. Set random value in cookie AND form field
// 2. Server verifies cookie value matches form value
// Works because attacker can't read cookies
res.cookie('csrf', token, { sameSite: 'strict' });
// Client sends token in header:
fetch('/api', { headers: { 'X-CSRF-Token': token } });

// Node.js - bcrypt
const hash = await bcrypt.hash(password, 12); // cost=12
const valid = await bcrypt.compare(password, hash);

# Python - argon2 (preferred)
from argon2 import PasswordHasher
ph = PasswordHasher()
hash = ph.hash(password)
ph.verify(hash, password)

• Use RS256 or ES256 (asymmetric) in production
• Set short expiry: exp = 15 min for access tokens
• Use refresh tokens (long-lived, stored securely)
• Always validate iss, aud, exp claims
• Never store secrets in JWT payload (it is base64, not encrypted)
• Reject "alg": "none" explicitly

• Regenerate session ID after login
• Set HttpOnly, Secure, SameSite on cookies
• Implement idle timeout (15-30 min) and absolute timeout (8-24 hrs)
• Invalidate session server-side on logout

// Zod (TypeScript)
const UserSchema = z.object({
  email: z.string().email().max(254),
  age: z.number().int().min(13).max(150),
  role: z.enum(['user', 'admin'])
});
const user = UserSchema.parse(req.body);

• Validate MIME type AND file extension
• Check magic bytes (file signature)
• Rename uploaded files (never use original name)
• Store outside webroot, serve via handler
• Set max file size server-side

# Nginx: redirect all HTTP to HTTPS
server {
  listen 80;
  return 301 https://$host$request_uri;
}

# .env file (NEVER commit this)
DATABASE_URL=postgres://user:pass@host:5432/db
JWT_SECRET=super-secret-key-here
API_KEY=sk_live_abc123

// Load in Node.js
import 'dotenv/config';
const dbUrl = process.env.DATABASE_URL;

# Always ignore these
.env
.env.*
*.pem
*.key
credentials.json
service-account.json

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 100,                   // 100 requests per window
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many requests' }
});
app.use('/api/', limiter);
// Stricter for auth endpoints
app.use('/api/login', rateLimit({ windowMs: 900000, max: 5 }));

# settings.py (Django REST Framework)
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
        'rest_framework.throttling.UserRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '50/hour',
        'user': '1000/day',
    }
}

http {
  limit_req_zone $binary_remote_addr
    zone=api:10m rate=10r/s;
}
server {
  location /api/ {
    limit_req zone=api burst=20 nodelay;
  }
}