Security Defense Layers - Application Playbook

Purpose

• Admit only validated inputs and execute database operations safely
• Reduce risk of injection, traversal, and session abuse

Defense layers

Input canonicalization and sanitization

• Remove directory traversal tokens and null bytes
• Normalize percent-encoding
• Strip disallowed characters
• Collapse repeated separators and whitespace

Query-parameter allow-list and validation

• Process only expected keys
• Apply per-key length caps
• Use anchored enums and format checks
• Add numeric and boolean guards
• Use safe defaults for invalid input

Slug routing and facet mapping

• Convert a normalized slug into an allowed facet
• Discard the raw slug value
• Return Not Found when no match exists

Database query safety

• Use prepared statements with bound parameters
• Avoid string concatenation
• Validate control flags
• Enforce input and type checks
• Centralize error handling

XSS defenses

• Use context-aware escaping in templates
• Sanitize user content
• Avoid inline scripts

CSRF protection

• Use per-request tokens
• Use SameSite cookies
• Allow state-changing actions via POST only

Cookie and session hardening

• Set HttpOnly
• Set Secure
• Set SameSite

File upload safety

• Enforce size limits
• Store uploads outside the webroot