DEV Community

Cover image for Top 10 Security Best Practices we learned the hard way

Top 10 Security Best Practices we learned the hard way

Raphael Jambalos on March 03, 2024

Our users entrusted us with their data and it's our duty to keep this data secure as they use our application. Unfortunately, security best practic...
Collapse
 
0x0saltyhash profile image
Ahmed M.Saeed

Using WAF is not an alternative to following best practices in preventing XSS, WAF can block suspicious payloads/requests but it WAF can be bypassed.

for example:

  • Input sanitization/validation.
  • Encoding of data to prevent the browser from interpreting it as HTML/JS Code.

WAF should be added as an extra layer of security.

Collapse
 
raphael_jambalos profile image
Raphael Jambalos

Agree on this, there is no substitute for proper input sanitation in an application. WAF's limitation on only being able to scan the first 500KB or so is problematic especially when addressing more sophisticated attacks