I am doing an app security project.
This app is like amazon, users can list listings, pay listings and chat with sellers. There is staff and customer accounts, staff can view databases of everything.
I am incharge of account management for customers and staff (login, signup, account database, settings and both front and backend) for my group project. I need to secure this portion based on OWASP 2021.
This are the recent ideas/mitigations I am planning to do (based on OWASP 2021).
- Broken Access Control
Session token (JWT) - Cryptographic failure
Hashed Password (bycrypt) - Injection
Parameterised Queries to prevent SQL (Python.Net), Input Validation - Insecure Design
Anti-bot (Cloudflare) - Security Misconfiguration
Locked Accounts - Identification and Authentication failures
2 Factor Authorisation (Email, phoen number OTP), Password validation. Password for database - Logging and monitoring failures
Logs for user actions - Server-side Request Forgery
Access Control List
Since its my first time doing app security,
What do you guys think? Do you have any other security suggestions for me?
Thanks