security-auditor

XSS prevention requires input sanitization, output encoding, and Content Security Policy (CSP) headers. Sanitize user inputs, encode data before rendering to the DOM, use libraries like DOMPurify, and deploy CSP to restrict script execution and mitigate injection risks.

Secure authentication combines JWT tokens with OAuth flows and secure cookie configuration. Store tokens securely, use HTTPS-only and SameSite cookie flags, validate token signatures server-side, implement refresh token rotation, and enforce Multi-Factor Authentication (MFA) for sensitive operations.

CSRF protection uses anti-forgery tokens, SameSite cookie attributes, and origin validation. Issue unique tokens per session, set SameSite=Strict or Lax on cookies, validate request origins, and verify tokens on state-changing requests to prevent unauthorized cross-site actions.

Yes. CSP headers work across modern web frameworks and APIs. Configure CSP policies in response headers to control resource loading, restrict inline scripts, and define trusted sources. Adjust directives based on your framework's architecture and gradually enforce via report-only mode first.

Continuously audit npm dependencies using npm audit, Snyk, or Dependabot. These tools identify vulnerable packages, suggest patched versions, and monitor for newly disclosed CVEs. Integrate scanning into CI/CD pipelines and prioritize high-severity vulnerabilities in direct dependencies.

Role-Based Access Control (RBAC) enforces granular permissions beyond authentication, ensuring users access only authorized resources. Rate limiting prevents brute-force attacks, API abuse, and denial-of-service threats. Together they create defense-in-depth against unauthorized and malicious access patterns.