What software security techniques should a backend developer know?
Answer
- Authentication (who are you): password hashing with bcrypt/Argon2, MFA, OAuth2/OIDC, JWT with correct validation.
- Authorization (what can you do): roles and permissions checked server-side on every request; avoid IDOR.
- Input validation and output encoding: stops SQL injection, XSS, path traversal.
- Transport and storage: TLS everywhere, encryption at rest, secrets in a vault.
- Dependencies: SCA scanning, SBOM, fast patching (Log4Shell lesson).
- Secure SDLC: threat modeling, code review, SAST/DAST in CI, least privilege, logging and monitoring without sensitive data.
- Reference: OWASP Top 10 and OWASP ASVS.
Practice this question in Repaso
