Security

Web application security is not optional. In 2026, the average cost of a data breach is $4.88 million, and the median time to exploit a newly disclosed vulnerability has dropped to under 72 hours. The OWASP Top 10, updated most recently in 2021 with a new revision expected in 2025, catalogs the most critical security risks facing web applications. Every vulnerability on this list is preventable with established engineering practices. This guide walks through each one with practical prevention steps, focusing on React and Next.js applications.

1. Broken Access Control

Broken access control occurs when users can act outside their intended permissions. This includes accessing other users' data by modifying URL parameters, bypassing access checks by directly navigating to restricted pages, escalating privileges by manipulating tokens or cookies, and accessing API endpoints without proper authorization.

Prevention in Next.js applications:

• Implement authorization checks on every API Route Handler and Server Action, not just the frontend
• Use middleware to verify authentication before rendering protected routes
• Validate that the authenticated user owns the resource they are requesting
• Default to deny. Explicitly grant access rather than trying to block unauthorized access
• Never rely on client-side route guards as your only access control

2. Cryptographic Failures

Cryptographic failures expose sensitive data through weak encryption, missing encryption, or improper key management. Common examples include storing passwords in plaintext or with weak hashing, transmitting data over HTTP instead of HTTPS, using deprecated algorithms like MD5 or SHA1 for security purposes, and hardcoding encryption keys in source code.

Prevention steps:

• Use bcrypt or Argon2 for password hashing, never MD5 or SHA1
• Enforce HTTPS everywhere with HSTS headers
• Encrypt sensitive data at rest using AES-256
• Store secrets in environment variables or a secrets manager, never in code
• Rotate encryption keys regularly and implement key versioning

3. Injection

Injection attacks occur when untrusted data is sent to an interpreter as part of a command or query. SQL injection remains the most common form, but NoSQL injection, OS command injection, and LDAP injection are also prevalent.

Prevention steps:

• Use parameterized queries or ORMs like Prisma that handle parameterization automatically
• Validate and sanitize all user input on the server side
• Apply the principle of least privilege to database accounts
• Never construct SQL queries by concatenating user input strings

4. Insecure Design

Insecure design refers to architectural flaws that cannot be fixed by a perfect implementation. This includes missing rate limiting on authentication endpoints, absence of anti-automation controls on critical business flows, failure to implement account lockout after repeated failed attempts, and lack of server-side validation for business logic rules.

Prevention requires threat modeling during the design phase:

1. Identify trust boundaries and data flows in your application
2. Enumerate potential abuse scenarios for each feature
3. Design mitigations before writing code
4. Review architecture decisions with security-focused team members

5. Security Misconfiguration

Security misconfiguration is the most common vulnerability in production applications. It includes default credentials on administrative interfaces, unnecessary services or ports exposed, verbose error messages that reveal stack traces to users, missing security headers, and overly permissive CORS configurations.

Essential security headers for Next.js applications:

• Content-Security-Policy to prevent XSS and data injection attacks
• Strict-Transport-Security to enforce HTTPS
• X-Content-Type-Options set to nosniff to prevent MIME type sniffing
• X-Frame-Options set to DENY or SAMEORIGIN to prevent clickjacking
• Referrer-Policy set to strict-origin-when-cross-origin

6. Vulnerable and Outdated Components

Using components with known vulnerabilities is one of the easiest attack vectors to exploit and one of the easiest to prevent. Automated tools scan the internet for applications using vulnerable library versions and exploit them at scale.

Prevention steps:

• Run npm audit regularly and fix critical and high vulnerabilities immediately
• Enable Dependabot or Renovate for automated dependency updates
• Remove unused dependencies to reduce your attack surface
• Subscribe to security advisories for your critical dependencies

7. Identification and Authentication Failures

Authentication failures include weak password policies, missing multi-factor authentication, session tokens that do not expire, and credential stuffing attacks against login endpoints.

Prevention steps:

• Enforce strong password requirements and check against known breached passwords
• Implement multi-factor authentication for all user accounts
• Set secure session configuration with HttpOnly, Secure, and SameSite cookie attributes
• Implement rate limiting and account lockout on authentication endpoints
• Use established authentication libraries like NextAuth.js or Clerk rather than building your own

8. Software and Data Integrity Failures

Integrity failures occur when code or data is modified without detection. This includes insecure CI/CD pipelines, unsigned software updates, deserialization of untrusted data, and reliance on CDN-hosted libraries without integrity verification.

Prevention: use Subresource Integrity for external scripts, verify package checksums, sign and verify software artifacts, and validate all serialized data on the server.

9. Security Logging and Monitoring Failures

Without adequate logging and monitoring, breaches go undetected for months. The median time to detect a breach is 204 days according to IBM. Implement comprehensive audit logging for authentication events, access to sensitive data, administrative actions, and failed authorization attempts. Send logs to a centralized, tamper-proof logging service and set up alerts for anomalous patterns.

10. Server-Side Request Forgery (SSRF)

SSRF occurs when an application fetches a remote resource based on user-supplied input without validating the destination. Attackers can use SSRF to access internal services, cloud metadata endpoints, and other resources behind the firewall.

Prevention steps:

• Validate and whitelist allowed destination URLs on the server
• Block requests to private IP ranges and cloud metadata endpoints
• Use network segmentation to limit the impact of SSRF
• Disable unnecessary URL schemes like file and gopher

At Udaan Technologies, every project follows OWASP guidelines. Our API routes implement CSRF protection, rate limiting, input validation, and HTML escaping by default. Our CI/CD pipelines include automated security scanning. If you need a security review of your application or want to build with security as a first-class concern, contact our engineering team.