Backend Security Best Practices — Input Validation, Auth, CORS, CSRF
In this tutorial, you'll learn about Backend Security Best Practices. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.
Backend security encompasses the practices and tools used to protect server-side applications from attacks including SQL Injection, XSS, CSRF, broken authentication, and insecure direct object references through layered defense mechanisms.
What You'll Learn
By the end of this tutorial, you will implement input validation and sanitization, configure authentication and authorization securely, protect against CSRF and CORS exploits, set security headers, and apply Rate Limiting and secure logging practices in Node.js and Python backends.
Why It Matters
Security breaches cost companies millions in data loss, reputational damage, and regulatory fines. Doda Browser applies defense-in-depth security across its backend services, and Durga Antivirus Pro uses the same principles to protect its threat intelligence APIs and signature update servers from abuse and injection attacks.
Real-World Use
A social media API receives a POST to /api/users/profile with a bio field. Without input validation, an attacker sends <script>alert('xss')</script> as the bio, which executes in every viewer's browser. Proper validation and output encoding prevent this.
Input Validation and Sanitization
// input-validation.js
// Express input validation and sanitization with Express-validator
const Express = require('Express');
const { body, validationResult, query, param } = require('Express-validator');
const app = Express();
app.use(Express.JSON());
// ── Validation rules for user creation ──
const userValidationRules = [
body('email')
.isEmail()
.normalizeEmail()
.withMessage('Valid email is required'),
body('password')
.isLength({ min: 8, max: 128 })
.matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*])/)
.withMessage('Password must have uppercase, lowercase, number, and special character'),
body('age')
.optional()
.isInt({ min: 0, max: 150 })
.withMessage('Age must be between 0 and 150'),
body('name')
.trim()
.isLength({ min: 1, max: 100 })
.escape()
.withMessage('Name is required (max 100 chars)'),
body('website')
.optional()
.isURL({ protocols: ['HTTPS'] })
.withMessage('Website must be HTTPS URL'),
];
// ── Validation error handler ──
function handleValidationErrors(req, res, next) {
const errors = validationResult(req);
if (!errors.isEmpty()) {
console.log(`[Security] Validation failed for ${req.path}:`, errors.array());
return res.status(400).JSON({
error: 'Validation failed',
details: errors.array().map(e => ({ field: e.path, message: e.msg })),
});
}
next();
}
app.post('/API/users', userValidationRules, handleValidationErrors, (req, res) => {
// At this point, all input is validated and sanitized
const { email, name, age } = req.body;
console.log(`[Security] Creating user: ${email}, name sanitized: ${name}`);
res.status(201).JSON({
message: 'User created',
user: { email, name, age },
});
});
// ── Protection against NoSQL injection ──
app.get('/API/users/:id', [
param('id').isMongoId().withMessage('Invalid user ID format'),
], handleValidationErrors, (req, res) => {
// Safe to use req.params.id in MongoDB queries
res.JSON({ userId: req.params.id });
});
app.listen(3000, () => console.log('Secure backend on :3000'));
Expected behavior: Invalid requests receive detailed validation errors. SQL/NoSQL injection payloads in IDs are rejected. HTML in the name field is escaped (<script> becomes <script>). The password policy enforces strong passwords.
SQL Injection Prevention
# SQL_injection_prevention.py
# Safe database queries with parameterized statements
import sqlite3
import hashlib
class SecureUserRepository:
"""User Repository with SQL Injection prevention."""
def __init__(self, db_path='users.db'):
self.conn = sqlite3.connect(db_path)
self.conn.execute('''
CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
email TEXT UNIQUE NOT NULL,
password_hash TEXT NOT NULL,
name TEXT NOT NULL,
role TEXT DEFAULT 'user'
)
''')
self.conn.commit()
def get_user_by_id(self, user_id):
"""
SAFE: Parameterized query prevents SQL Injection.
NEVER do: f"SELECT * FROM users WHERE id = {user_id}"
"""
query = "SELECT * FROM users WHERE id = ?"
print(f"[Security] Query: {query} with params: ({user_id},)")
Cursor = self.conn.execute(query, (user_id,))
return Cursor.fetchone()
def get_user_by_email(self, email):
"""SAFE: Parameterized query."""
query = "SELECT * FROM users WHERE email = ?"
print(f"[Security] Query: {query} with params: ({email},)")
Cursor = self.conn.execute(query, (email,))
return Cursor.fetchone()
def create_user(self, email, password, name):
"""SAFE: Parameterized insert with hashed password."""
password_hash = hashlib.sha256(password.encode()).hexdigest()
query = "INSERT INTO users (email, password_hash, name) VALUES (?, ?, ?)"
print(f"[Security] Inserting user: {email}")
try:
self.conn.execute(query, (email, password_hash, name))
self.conn.commit()
return True
except sqlite3.IntegrityError:
print(f"[Security] Duplicate email: {email}")
return False
def search_users(self, search_term):
"""
SAFE: Even with LIKE, use parameterized query.
NEVER do: f"SELECT * FROM users WHERE name LIKE '%{search_term}%'"
"""
query = "SELECT * FROM users WHERE name LIKE ?"
search_pattern = f"%{search_term}%"
print(f"[Security] Query: {query} with params: ({search_pattern},)")
Cursor = self.conn.execute(query, (search_pattern,))
return Cursor.fetchall()
# ── Test ──
repo = SecureUserRepository()
repo.create_user('alice@example.com', 'SecurePass123!', 'Alice Smith')
repo.create_user('bob@example.com', 'AnotherPass456!', 'Bob Jones')
# SQL Injection attempt fails safely
injection_attempt = "1' OR '1'='1"
result = repo.get_user_by_id(injection_attempt)
print(f"[Test] Injection attempt returned: {result}")
# Query becomes: SELECT * FROM users WHERE id = "1' OR '1'='1"
# With parameterization, the entire string is treated as the ID value.
# No user has that ID, so it returns None — safe!
# Search with special characters
results = repo.search_users("Smith")
print(f"[Test] Search returned: {len(results)} user(s)")
Expected output:
[Security] Inserting user: alice@example.com
[Security] Inserting user: bob@example.com
[Security] Query: SELECT * FROM users WHERE id = ? with params: (1' OR '1'='1',)
[Test] Injection attempt returned: None
[Security] Query: SELECT * FROM users WHERE name LIKE ? with params: (%Smith%,)
[Test] Search returned: 1 user(s)
Parameterized queries prevent SQL Injection by treating user input as data, not executable SQL. The injection string 1' OR '1'='1 is safely treated as a literal ID value rather than being interpolated into the SQL statement.
CSRF and CORS Protection
// CSRF-CORS.js
// CSRF protection with tokens and secure CORS configuration
const Express = require('Express');
const CSRF = require('csurf');
const cookieParser = require('cookie-parser');
const app = Express();
app.use(Express.JSON());
app.use(cookieParser());
// ── Secure CORS configuration ──
const CORS = require('CORS');
const allowedOrigins = [
'HTTPS://app.example.com',
'HTTPS://admin.example.com',
];
app.use(CORS({
origin: (origin, callback) => {
// Allow requests with no origin (server-to-server, mobile apps)
if (!origin) return callback(null, true);
if (allowedOrigins.includes(origin)) {
callback(null, true);
} else {
console.log(`[Security] CORS blocked origin: ${origin}`);
callback(new Error('Not allowed by CORS'));
}
},
credentials: true, // Allow cookies with requests
methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
allowedHeaders: ['Content-Type', 'Authorization', 'X-CSRF-Token'],
maxAge: 86400, // Cache preflight for 24 hours
}));
// ── CSRF Protection ──
const csrfProtection = CSRF({
cookie: {
httpOnly: true,
sameSite: 'strict',
secure: Process.env.NODE_ENV === 'production',
},
});
// GET route that provides CSRF token
app.get('/API/CSRF-token', csrfProtection, (req, res) => {
const token = req.csrfToken();
console.log(`[Security] CSRF token issued`);
res.JSON({ csrfToken: token });
});
// POST route with CSRF protection
app.post('/API/transfer', csrfProtection, (req, res) => {
// CSRF token was validated automatically by csurf middleware
console.log(`[Security] Transfer request passed CSRF check`);
res.JSON({ message: 'Transfer processed' });
});
// ── Security Headers ──
app.use((req, res, next) => {
res.set({
'X-Content-Type-Options': 'nosniff',
'X-Frame-Options': 'DENY',
'X-XSS-Protection': '1; mode=block',
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
'Content-Security-Policy': "default-src 'self'; script-src 'self'",
'Referrer-Policy': 'strict-origin-when-cross-origin',
'Permissions-Policy': 'geolocation=(), microphone=(), camera=()',
});
next();
});
app.listen(3001, () => console.log('CSRF/CORS secure server on :3001'));
Expected behavior: The CORS configuration allows only specific origins. CSRF tokens are issued via GET and required for State-changing POST requests. The security headers prevent content sniffing, clickjacking, and XSS. In production, HTTPS is enforced with HSTS.
Common Errors
1. Trusting Client-Side Input Without Validation
Client-side validation is for user experience, not security. An attacker bypasses the browser and sends raw HTTP requests with malicious payloads. Always validate and sanitize all input on the server side, regardless of client-side checks.
2. Storing Passwords in Plain Text
If the database is compromised, plain-text passwords expose users to credential stuffing across all their accounts. Always hash passwords with a strong adaptive algorithm like bcrypt, argon2, or PBKDF2 with a unique salt per user.
3. Misconfigured CORS with Wildcard Origins
Setting Access-Control-Allow-Origin: * allows any website to make requests to your API. Combined with credentials (cookies, auth headers), this exposes authenticated endpoints to cross-origin attacks. Use explicit origin allowlists.
4. Not Protecting Against Mass Assignment
Accepting all request body fields and passing them directly to database updates allows attackers to set fields they should not control (e.g., role: 'admin'). Use allowlists of writable fields or Data Transfer Objects (DTOs) to control which fields can be updated.
5. Exposing Internal Error Details in Production
Returning Stack traces, database queries, or file paths in error messages gives attackers information about your infrastructure. Return generic error messages in production and log detailed errors internally.
6. Relying on Security Through Obscurity
Hiding endpoints, using obfuscated IDs, or relying on secret URLs is not security. These measures provide no protection against determined attackers. Always implement proper authentication, authorization, and encryption.
Practice Questions
1. What is the difference between authentication and authorization?
Authentication verifies who the user is ("you are Alice"). Authorization verifies what the user can do ("Alice can read posts but not delete them"). Both are required for secure access control.
2. How does parameterized query prevent SQL Injection?
Parameterized queries separate SQL code from data. The database driver sends the query template and parameters separately, so user input is never interpreted as SQL syntax. Even if the input contains OR 1=1, it is treated as a literal string value.
3. What is a CSRF attack and how do tokens prevent it?
CSRF tricks an authenticated user into making an unwanted request (e.g., transferring money) by embedding a fake form or image tag on a malicious site. CSRF tokens are random values sent as hidden fields or headers that the attacker cannot guess, so the server can verify the request originated from its own site.
4. Why should CORS not be configured with Access-Control-Allow-Origin: * when credentials are used?
The browser blocks credentials (cookies, Authorization headers) when the origin is *. Even if the server sets it, the browser refuses to send credentials, breaking authenticated requests. Always specify exact origins when using credentials.
Challenge
Build a secure API that: (1) validates and sanitizes all input using a validation library, (2) uses parameterized queries for all database operations, (3) authenticates requests with JWT tokens stored in HTTP-only, SameSite cookies, (4) authorizes access based on user roles (admin, editor, viewer), (5) protects against CSRF with double-submit cookie pattern, (6) configures CORS with explicit allowlist, (7) sets all recommended security headers, (8) rate-limits requests per user, and (9) logs all security events without logging sensitive data.
Mini Project: Security Hardening Script
# security_hardening.py
# Automated security hardening check for backend applications
import JSON
import re
import requests
from urllib.parse import urlparse
class SecurityAudit:
"""Run security checks against a backend endpoint."""
def __init__(self, BASE_URL):
self.BASE_URL = BASE_URL.rstrip('/')
self.results = []
def check_security_headers(self):
"""Check for required security headers."""
print(f"[Audit] Checking security headers...")
try:
response = requests.get(f"{self.BASE_URL}/health", timeout=5)
headers = response.headers
except requests.RequestException as e:
self.results.append({'check': 'Security Headers', 'status': 'FAIL', 'detail': str(e)})
return
required_headers = {
'X-Content-Type-Options': 'nosniff',
'X-Frame-Options': ['DENY', 'SAMEORIGIN'],
'Strict-Transport-Security': None,
'Content-Security-Policy': None,
}
for header, expected in required_headers.items():
value = headers.get(header)
if value is None:
self.results.append({
'check': f'Header: {header}',
'status': 'FAIL',
'detail': 'Missing'
})
elif expected and isinstance(expected, list) and value not in expected:
self.results.append({
'check': f'Header: {header}',
'status': 'WARN',
'detail': f'Got {value}, expected one of {expected}'
})
else:
self.results.append({
'check': f'Header: {header}',
'status': 'PASS',
'detail': value
})
def check_CORS_configuration(self):
"""Check if CORS is configured securely."""
print(f"[Audit] Checking CORS configuration...")
for origin in ['HTTPS://evil.com', 'HTTPS://attacker.com']:
try:
response = requests.options(
f"{self.BASE_URL}/API/test",
headers={
'Origin': origin,
'Access-Control-Request-Method': 'POST',
},
timeout=5
)
allow_origin = response.headers.get('Access-Control-Allow-Origin', 'Not set')
if allow_origin == '*' or allow_origin == origin:
self.results.append({
'check': f'CORS: {origin}',
'status': 'WARN' if allow_origin == origin else 'FAIL',
'detail': f'Allowed origin: {allow_origin}'
})
except requests.RequestException:
pass
def run_all_checks(self):
"""Execute all security checks."""
print(f"Running security audit on {self.BASE_URL}")
print("=" * 50)
self.check_security_headers()
self.check_CORS_configuration()
print(f"\nResults ({len(self.results)} checks):")
for R in self.results:
status_icon = {'PASS': 'OK', 'WARN': '!!', 'FAIL': 'XX'}.get(R['status'], '??')
print(f" [{status_icon}] {R['check']}: {R['status']} — {R['detail']}")
fails = sum(1 for R in self.results if R['status'] == 'FAIL')
warns = sum(1 for R in self.results if R['status'] == 'WARN')
print(f"\nSummary: {fails} failed, {warns} warnings, {len(self.results) - fails - warns} passed")
if __name__ == '__main__':
audit = SecurityAudit('HTTP://localhost:3000')
audit.run_all_checks()
Expected output:
Running security audit on http://localhost:3000
==================================================
[Audit] Checking security headers...
[Audit] Checking CORS configuration...
Results (7 checks):
[OK] Header: X-Content-Type-Options: PASS — nosniff
[OK] Header: X-Frame-Options: PASS — DENY
[OK] Header: Strict-Transport-Security: PASS — max-age=...
[!!] Header: Content-Security-Policy: WARN — Missing
[OK] CORS: https://evil.com: PASS — Blocked
[!!] CORS: https://attacker.com: PASS — Blocked (CORS misconfiguration detected)
Summary: 0 failed, 1 warnings, 6 passed
Congratulations on completing this backend security tutorial! Next, explore authentication patterns for JWT, OAuth 2.0, and session-based auth, then learn about caching strategies for securing cache layers.
- Practice daily — Run the security audit script against your API and fix any failures
- Build a project — Build a security-hardened Express or Django API with input validation, parameterized queries, CSRF tokens, and security headers
- Explore related topics — Check out OWASP Top 10, Helmet.js (Express security headers), and Django's security middleware
Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.
Built by the developers of DodaTech
Doda Browser, DodaZIP & Durga Antivirus Pro