Web security foundations — JWT · OAuth · OWASP
Practical security in eight steps — auth, validation, headers, CORS, email verification, and row-level security.
- Difficulty
- Intermediate
- Lessons
- 8
Most of OWASP Top 10 is handled by popular frameworks by default, but boundary and trust decisions still fall on the developer. A handful of concrete patterns shrink the attack surface a lot.
Who it's for
- Developers without a clear sense of "how far is enough" on security
- Teams that adopted JWT · OAuth but are nervous about mistakes
- Anyone wanting to set CORS, headers, and rate limits properly
What you can do afterwards
- Design JWT rotation · refresh tokens · blacklist
- Handle OAuth state · PKCE · CSRF
- Validate input with zod + length caps
- Apply Redis-based rate limiting (sliding window)
- Configure security headers · CSP · CORS
- Harden anonymous forms with honey-pot · IP hashing
- Verify email with OTP — generation, verification, resend throttling
- Close direct SQL and SDK bypass paths with PostgreSQL row-level security
Flow
Defense from request to data
Establish a threat model and separate the trust boundaries of JWT and OAuth.
Reduce malicious request surface with validation, rate limits, and CSP.
Make retries, expiration, and failure states explicit in hardened forms and OTP flows.
Keep authorization intact with RLS even when an API path is bypassed.
Steps 1–3 identify who is coming in, 4–7 protect requests and verification, and step 8 keeps the data boundary intact even when an API path is bypassed.
Steps
- Threat model · OWASP at a glance — Top 10 · real incident distribution
- JWT · refresh · rotation — HS256 vs RS256 · expiry · blacklist
- OAuth + state · PKCE — Kakao · Naver · CSRF
- Input validation + length caps — zod · Valibot · payload flood defence
- Rate limit + CORS + security headers — Redis sliding window · CSP ·
sameSite - Anonymous form hardening — honey-pot · IP hash · status flow
- Email verification and OTP — SMTP · app password · OTP generation/verification · rate limiting
- Row-level security — roles · USING · WITH CHECK · deployed policy drift
Prerequisites — complete either backend-with-spring or nextjs-fullstack.