Skip to main content

Security Best Practices

Server to Server​

Authentication and Authorization​

  • Use API keys to authenticate communications between servers.
  • Store API keys securely. Never expose them in logs, error messages, or version-controlled code.

Data Encryption​

  • Ensure all data exchanged between servers is encrypted using HTTPS with TLS 1.2 or TLS 1.3.

Input Validation​

  • Validate and sanitize all incoming data to protect against injection attacks and malformed input.

Logging and Monitoring​

  • Keep detailed logs of server communications and API usage.
  • Retain logs for 30 days, then securely delete them.
  • Monitor usage patterns to detect anomalies and potential threats.

Network Security​

  • Host backend systems in a protected internal network.
  • Use a load balancer to distribute traffic and mask internal infrastructure.
  • Only expose necessary ports (e.g., 443 for HTTPS); block unused ports using firewall rules.

User Agent​

  • Include a clearly defined user-agent string in all server-side API requests to identify source systems.

Web to Server​

Authentication and Authorization​

  • Require API keys for web applications when communicating with backend servers.
  • Keep API keys secure; do not embed them in frontend code or expose them in client-side logs.

Data Encryption​

  • Use HTTPS with TLS 1.2 or 1.3 to protect data in transit between the browser and server.

Input Validation​

  • Apply strict validation on both the client and server sides.
  • Use CSRF protection tokens to prevent cross-site request forgery.
  • Reject unexpected special characters that may lead to injection attacks.

Security Headers​

  • Use standard HTTP security headers such as:
    • Content-Security-Policy
    • X-Content-Type-Options
    • X-Frame-Options
    • X-XSS-Protection
    • Strict-Transport-Security (HSTS)

Network Security​

  • Deploy web servers within a secure network environment.
  • Use load balancers to manage incoming traffic and protect backend systems.
  • Close all non-essential ports and use firewall rules to enforce strict access control.

Logging and Monitoring​

  • Retain access and error logs for 30 days with secure deletion afterward.
  • Monitor traffic in real-time to detect abnormal activity.
  • Ensure sensitive data is not logged in error messages or browser responses.

Web Application Firewall (WAF)​

  • Implement a WAF to protect against common web attacks such as SQL injection and XSS.
  • Update WAF rules regularly to respond to new threat vectors.
  • Use throttling to prevent abuse and denial-of-service scenarios.

CAPTCHA​

  • Implement CAPTCHA on forms to prevent automated abuse and bot traffic.

User Agent​

  • Use a consistent and identifiable user agent in requests for traffic tracking.

Handling Sensitive Data​

  • Avoid exposing sensitive data in HTML or frontend code.
  • Do not include confidential details in response payloads or error messages.
  • Do not store credentials or API tokens in local storage or cookies.

JavaScript Best Practices​

  • Avoid inline JavaScript within HTML content.
  • Load scripts from trusted sources using external files with proper security attributes (e.g., integrity checks).