Core Code
Core Code Modern Dev Handbook
APPLICATION-SECURITY Contents
Security Foundations for Production Apps
Threat Modeling (Practical, Repeatable) OWASP Top 10 (Operator Lens) Defense in Depth (Layered Controls That Hold) Security Baselines and Checklists (What “Good” Looks Like) Secrets in Apps (Storage, Injection, Rotation) Logging Sensitive Data (Pitfalls and Redaction) Rate Limiting Patterns (Abuse and Resilience) Abuse Prevention (Bots, Fraud, Enumeration) HTTPS & TLS Realities (HSTS, Termination, Cert Ops) Secure Headers Baseline (Production Defaults)
Identity, Authentication, and Sessions
Sessions vs JWT (Production Tradeoffs) JWT Attack Patterns and Validation Pitfalls Password Hashing Ops (bcrypt/argon2 Parameters) OAuth2 Flows in Practice (Auth Code + PKCE) OIDC Internals (Discovery, JWKS, Claims) Token Revocation Strategies (What Actually Works) Refresh Token Abuse and Rotation Defenses API Key Management (Issuance, Rotation, Scoping) mTLS Basics (Service-to-Service Identity) Identity Boundary Design (Trust Zones)
Web Attacks and Practical Defenses
XSS in Production (Exploit Paths and CSP Hardening) CSRF (SameSite Reality vs Token Defenses) SSRF (Cloud Metadata Abuse and Egress Controls) Clickjacking (Frame Controls and UI Redress) SQL Injection (Production Defense Patterns) CORS Misconfigurations (Real-World Impact) CSP Practical Recipes (Deployable Policies) Secure Cookie Patterns (HttpOnly, Secure, SameSite) Request Validation Patterns (What to Validate Where) File Upload Hardening (Content Sniffing, AV, Storage)
Secure Delivery, Hardening, and Incident Response
Secure SDLC (Gates That Don’t Kill Delivery) Dependency Risks (Vulns, Updates, Policies) App Supply Chain (Lockfiles, Pinning, Review) Configuration Hardening (Safe Defaults Checklist) Security Monitoring Signals (Auth, Data, Network) Security Alert Design (Noise, Triage, Escalation) WAF Realities (What It Stops and What It Doesn’t) Credential Leak Runbook (Keys, Tokens, Passwords) Compromised Token Runbook (JWT/OAuth Sessions) Security Incident Response (Contain, Eradicate, Recover)

HTTPS & TLS Realities (HSTS, Termination, Cert Ops)

Run HTTPS correctly in production: termination, proxy headers, HSTS, certificate rotation, and common TLS failure modes with checks.
On this page

Production TLS Reality

Most outages come from termination misconfig, missing proxy headers, expired certificates, or mixed termination layers. Operate TLS as a lifecycle.

Minimum Requirements

  • TLS 1.2+ only (prefer 1.3 where possible)
  • HSTS enabled after confirming HTTPS-only
  • Correct X-Forwarded-Proto and host handling behind proxies
  • Automated certificate renewal with monitoring

Certificate Expiry Checks

# Show cert dates
echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null 
| openssl x509 -noout -dates -subject -issuer

HSTS Rollout

  • Start with short max-age, verify no HTTP dependencies.
  • Then increase max-age gradually.
  • Be careful with preload; it is hard to undo.

Reverse Proxy Gotchas

# If app is behind a proxy, ensure it knows the original scheme
# Otherwise redirects can loop or cookies can lose Secure attribute

# Example header check
curl -sS -D - https://app.example.com/ -o /dev/null | egrep -i "strict-transport-security"

Failure Modes

  • Expired cert: alerts missing; add daily expiry checks.
  • Redirect loops: wrong forwarded proto; fix proxy/app config.
  • Mixed content: browser blocks; enforce HTTPS on all assets.
Secure Headers Baseline (Production Defaults) →