The four aspects of a secure web app

Securing a website is often compared to installing a lock on a door. In reality, that is a poor analogy. A more apt analogy would be fortifying a castle. When a castle is besieged, a locked gate alone offers little protection. A castle needs multiple layers of defense, where each layer protects the next.

It is crucial to understand what you are trying to procect: the data. All the security layers revolve around safeguarding it. That’s why a secure application has the following aspects:

Aspect 1: Proper Identity- and Access Management

The most obvious way to secure your website is by allowing only authenticated users to access the application. This ensures that only authorized individuals have access to the system.

User management is a critical and sensitive component of any application. Compromising user management can have severe consequences for the entire system’s security.

As security protocols evolve and become more intricate, implementing an effective identity and access management system demands specialized expertise that you cannot expect every developer to have. Therefore, it is highly advisable to utilize third-party identity and access management services. Providers such as Auth0 or Azure Active Directory can offer robust solutions in this regard.

It is strongly recommended to leverage third-party open source libraries for integrating these IAM solutions into your applications. However, it is important to ensure that these libraries are OpenID Connect-approved. You can find a list of approved libraries here.

Also, ensure that sensitive authentication processes no longer take place on the client-side; instead, shift them to the server-side using the BFF Security Pattern. This can be easily implemented with libraries such as Duende Bff, or, if for any reason that’s not an option, GoCloudNative.Bff.

Aspect 2: A secure infrastructure with as few passwords or secrets as possible

As I mentioned earlier, securing a website with a login screen is like putting a lock on the door. However, that alone is not sufficient. A determined intruder will always attempt to find a…