Web security foundations — JWT · OAuth · OWASP

Most of OWASP Top 10 is handled by popular frameworks by default, but boundary and trust decisions still fall on the developer. A handful of concrete patterns shrink the attack surface a lot.

Who it's for

• Developers without a clear sense of "how far is enough" on security
• Teams that adopted JWT · OAuth but are nervous about mistakes
• Anyone wanting to set CORS, headers, and rate limits properly

What you can do afterwards

• Design JWT rotation · refresh tokens · blacklist
• Handle OAuth state · PKCE · CSRF
• Validate input with zod + length caps
• Apply Redis-based rate limiting (sliding window)
• Configure security headers · CSP · CORS
• Harden anonymous forms with honey-pot · IP hashing
• Verify email with OTP — generation, verification, resend throttling
• Close direct SQL and SDK bypass paths with PostgreSQL row-level security

Flow

Defense from request to data

1Threat and identity

Establish a threat model and separate the trust boundaries of JWT and OAuth.

2Input and browser

Reduce malicious request surface with validation, rate limits, and CSP.

3Verification

Make retries, expiration, and failure states explicit in hardened forms and OTP flows.

4Data boundary

Keep authorization intact with RLS even when an API path is bypassed.

Steps 1–3 identify who is coming in, 4–7 protect requests and verification, and step 8 keeps the data boundary intact even when an API path is bypassed.

Steps

1. Threat model · OWASP at a glance — Top 10 · real incident distribution
2. JWT · refresh · rotation — HS256 vs RS256 · expiry · blacklist
3. OAuth + state · PKCE — Kakao · Naver · CSRF
4. Input validation + length caps — zod · Valibot · payload flood defence
5. Rate limit + CORS + security headers — Redis sliding window · CSP · sameSite
6. Anonymous form hardening — honey-pot · IP hash · status flow
7. Email verification and OTP — SMTP · app password · OTP generation/verification · rate limiting
8. Row-level security — roles · USING · WITH CHECK · deployed policy drift

Prerequisites — complete either backend-with-spring or nextjs-fullstack.