Why Security Can't Be an Afterthought
Every week, thousands of web applications are compromised. Customer databases sold on the dark web, ransomware paralyzing entire companies, personal data exposed. Most of these incidents could have been prevented with basic practices.
At Unziptech, security is built in from day one — not added at the last minute. Here are the seven practices we apply on every project.
1. Validate and Sanitize All Input
The golden rule: never trust data coming from the outside. Forms, URL parameters, HTTP headers, JSON payloads — everything must be validated and sanitized before processing.
On the backend (Spring Boot), we use Bean Validation with annotations like @NotBlank, @Size, @Pattern. SQL injection is eliminated by using parameterized queries or ORMs (Hibernate, JPA) that never interpolate user data directly into queries.
2. Robust Authentication with JWT and Refresh Tokens
Cookie-based sessions are increasingly ill-suited to modern architectures (API-first, microservices). We systematically use:
- JWT (JSON Web Tokens) for access tokens, with a short lifespan (15-30 minutes)
- Refresh tokens encrypted, stored in the database, rotated on every use
- bcrypt hashing (or Argon2) for passwords — never plain MD5 or SHA-1
3. HTTPS Everywhere, HSTS Enabled
No application we deliver runs on unencrypted HTTP. The TLS certificate (via Let's Encrypt) is set up from the first deployment, and the Strict-Transport-Security header forces the browser to always use HTTPS.
4. HTTP Security Headers
A few lines of server or middleware configuration that make a big difference:
Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
These headers protect against XSS attacks, clickjacking, and MIME sniffing.
5. Secure Secret Management
API keys, database passwords, JWT secrets must never appear in source code. We use:
- Environment variables injected at deployment time
- GitHub Secrets or Vault for CI/CD pipelines
- Regular rotation of critical keys
A simple git log should never reveal a secret.
6. Rate Limiting
Without rate limiting, your authentication endpoints are vulnerable to brute-force attacks. We systematically configure limits on:
- Login routes (5 attempts / minute per IP)
- Public API endpoints (100 requests / minute)
- Form submissions (anti-spam protection)
7. Automated Dependency Audits
Your NPM or Maven dependencies may contain known vulnerabilities. Our CI/CD pipelines run npm audit and mvn dependency-check:check on every build. Critical dependencies are updated with priority.
Security as Culture, Not Checklist
These practices aren't a one-time list to check — they must be part of the development culture. At Unziptech, every code review includes a security dimension, and we regularly train our team on emerging threats.
Your application deserves this rigor. Let's talk about your project.
Published by Unziptech.com, the owner of this blog, and connected to rentalme.ma, its car-rental product.