Web Application Security Testing Checklist Before You Launch

Passwords hashed with bcrypt, scrypt, or Argon2 — not MD5, SHA1, or plain SHA256

Login endpoint rate-limited — brute force requires more than a few thousand requests

Account lockout or CAPTCHA after repeated failed logins

Session tokens are cryptographically random — not sequential or predictable

Session invalidated on logout — not just deleted client-side

Session invalidated after password change

Session cookie has HttpOnly flag — not readable by JavaScript

Session cookie has Secure flag — only sent over HTTPS

Session cookie has SameSite=Strict or Lax — CSRF protection

Password reset tokens are single-use and expire within 1 hour

Password reset tokens are invalidated after use — not reusable

Multi-factor authentication available for privileged accounts

Every API endpoint verifies the requesting user owns the accessed resource (IDOR check)

Admin-only endpoints return 403 for non-admin users — not 404 or 200 with empty data

Authorization checked server-side — not based on client-supplied role or flag

Horizontal privilege: User A cannot access User B's data by changing an ID

Vertical privilege: Regular users cannot access admin functionality by direct URL

Inactive or deleted users' data is inaccessible — not just hidden from the UI

API endpoints that accept a user ID in the request body validate it against the authenticated session

SQL queries use parameterized queries or prepared statements — no string concatenation

All user input rendered in HTML is output-encoded — no raw innerHTML with user data

File uploads validate MIME type server-side — not just the file extension

File upload filenames are sanitized or replaced before storage

Uploaded files are not directly executable — stored outside web root or behind a CDN

XML parsing has external entity processing disabled (XXE prevention)

Server-side template rendering uses safe context — no user input evaluated as template code

Command execution functions do not include user-supplied input without strict allowlist validation

Redirect targets are validated against an allowlist — open redirects blocked

All API endpoints require authentication — no accidentally public endpoints

API rate limiting in place — bulk data extraction requires unusual request volume

GraphQL introspection disabled in production

GraphQL query depth and complexity limits set — no unbounded nested queries

CORS policy is restrictive — wildcard (*) origin not used with credentialed requests

API versioning in place — deprecated endpoints return 410 Gone, not live responses

Error responses do not include stack traces, SQL errors, or internal paths

JWT tokens validated server-side — algorithm, expiry, and signature all checked

JWT secret is strong and rotated — not a default or weak value

All data in transit encrypted with TLS 1.2+ — no HTTP endpoints for authenticated routes

HSTS header set — browsers enforce HTTPS for all future visits

Sensitive data (passwords, tokens, keys) not logged — check application logs

API responses return only necessary fields — no accidental user data leakage in bulk endpoints

Database connection strings and API keys not in version control or client-side code

Backup files and old deployments not accessible via predictable URLs

Debug mode disabled in production — no verbose error pages

Directory listing disabled on all web servers

Default credentials changed on all services — databases, admin panels, cloud consoles

Unnecessary services and ports closed — attack surface minimized

Security headers set: X-Frame-Options, X-Content-Type-Options, Referrer-Policy

Content Security Policy defined — inline scripts restricted or eliminated

Dependency vulnerabilities scanned — no known CVEs in production dependencies

Cloud storage buckets not publicly readable unless intentionally public

Internal admin interfaces not exposed to the public internet

Subdomains enumerated and secured — forgotten staging environments removed