Web Security Best Practices for 2026

# Example: Implementing TOTP-based MFA
import pyotp
import qrcode
from flask import Flask, request, session

def generate_mfa_secret():
    """Generate a new MFA secret for user enrollment"""
    return pyotp.random_base32()

def get_totp_uri(secret, user_email):
    """Generate QR code URI for authenticator apps"""
    totp = pyotp.TOTP(secret)
    return totp.provisioning_uri(user_email, issuer_name="MyApp")

def verify_totp(secret, token):
    """Verify TOTP token with time drift tolerance"""
    totp = pyotp.TOTP(secret)
    return totp.verify(token, valid_window=1)

@app.route('/setup-mfa', methods=['POST'])
def setup_mfa():
    secret = generate_mfa_secret()
    uri = get_totp_uri(secret, current_user.email)
    # Store secret temporarily until verified
    session['mfa_secret'] = secret
    return jsonify({'qr_uri': uri})

@app.route('/verify-mfa', methods=['POST'])
def verify_mfa_setup():
    token = request.json.get('token')
    secret = session.get('mfa_secret')
    if verify_totp(secret, token):
        current_user.mfa_secret = secret
        db.session.commit()
        return jsonify({'status': 'success'})
    return jsonify({'status': 'invalid'}), 400

import re
from zxcvbn import zxcvbn

def validate_password_strength(password, user_inputs=None):
    """
    Validate password strength using zxcvbn library
    Returns score from 0 (weak) to 4 (strong)
    """
    if len(password) < 12:
        return False, "Password must be at least 12 characters"

    result = zxcvbn(password, user_inputs=user_inputs or [])

    if result['score'] < 3:
        feedback = result['feedback']['suggestions']
        return False, f"Password too weak: {' '.join(feedback)}"

    return True, "Password is strong"

# Usage
is_valid, message = validate_password_strength(
    "mySecurePass123!",
    user_inputs=["john", "example.com"]
)

# nginx TLS Configuration
server {
    listen 443 ssl http2;
    server_name example.com;

    # Certificate configuration
    ssl_certificate /etc/ssl/certs/example.com.pem;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    # TLS 1.3 only (or 1.2 as fallback)
    ssl_protocols TLSv1.3 TLSv1.2;

    # Strong cipher suites
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # Session configuration
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/certs/chain.pem;

    # HSTS
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
}

// Certificate pinning in Node.js
const https = require('https');
const crypto = require('crypto');

const TRUSTED_PINS = [
    'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
    'sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB='
];

function verifyPin(certificate) {
    const fingerprint = crypto
        .createHash('sha256')
        .update(certificate.raw)
        .digest('base64');
    const pin = `sha256/${fingerprint}`;

    if (!TRUSTED_PINS.includes(pin)) {
        throw new Error('Certificate pin mismatch!');
    }
    return true;
}

from marshmallow import Schema, fields, validate, ValidationError
import bleach
from markupsafe import escape

class UserRegistrationSchema(Schema):
    username = fields.Str(
        required=True,
        validate=[
            validate.Length(min=3, max=30),
            validate.Regexp(r'^[a-zA-Z0-9_]+$', error="Only alphanumeric and underscore allowed")
        ]
    )
    email = fields.Email(required=True)
    age = fields.Int(validate=validate.Range(min=13, max=120))
    bio = fields.Str(validate=validate.Length(max=500))

def sanitize_input(text, allowed_tags=None):
    """Sanitize HTML input to prevent XSS"""
    if allowed_tags is None:
        allowed_tags = ['b', 'i', 'u', 'em', 'strong']

    return bleach.clean(
        text,
        tags=allowed_tags,
        attributes={},
        strip=True
    )

def validate_and_process_registration(data):
    schema = UserRegistrationSchema()
    try:
        validated = schema.load(data)
        validated['bio'] = sanitize_input(validated.get('bio', ''))
        return validated
    except ValidationError as err:
        return None, err.messages

# Using parameterized queries with SQLAlchemy
from sqlalchemy import text

# NEVER do this:
# query = f"SELECT * FROM users WHERE id = {user_id}"

# ALWAYS use parameterized queries:
def get_user_by_id(user_id: int):
    query = text("SELECT * FROM users WHERE id = :user_id")
    result = db.session.execute(query, {"user_id": user_id})
    return result.fetchone()

# With ORM (even safer):
def get_user_orm(user_id: int):
    return User.query.filter_by(id=user_id).first()

# Flask Security Headers Middleware
from flask import Flask, Response
from functools import wraps

SECURITY_HEADERS = {
    'X-Content-Type-Options': 'nosniff',
    'X-Frame-Options': 'SAMEORIGIN',
    'X-XSS-Protection': '1; mode=block',
    'Referrer-Policy': 'strict-origin-when-cross-origin',
    'Permissions-Policy': 'geolocation=(), microphone=(), camera=()',
    'Content-Security-Policy': (
        "default-src 'self'; "
        "script-src 'self' https://trusted-cdn.com 'nonce-{nonce}'; "
        "style-src 'self' 'unsafe-inline'; "
        "img-src 'self' data: https:; "
        "font-src 'self'; "
        "connect-src 'self'; "
        "frame-ancestors 'none'; "
        "base-uri 'self'; "
        "form-action 'self';"
    ),
    'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload'
}

def add_security_headers(response: Response):
    """Add all security headers to response"""
    for header, value in SECURITY_HEADERS.items():
        if header == 'Content-Security-Policy':
            # Generate unique nonce for each request
            import secrets
            nonce = secrets.token_urlsafe(16)
            value = value.format(nonce=nonce)
            response.nonce = nonce
        response.headers[header] = value
    return response

app = Flask(__name__)
app.after_request(add_security_headers)

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

limiter = Limiter(
    app=app,
    key_func=get_remote_address,
    default_limits=["200 per day", "50 per hour"],
    storage_uri="redis://localhost:6379"
)

@app.route('/api/login', methods=['POST'])
@limiter.limit("5 per minute")
def login():
    # Login logic
    pass

@app.route('/api/sensitive')
@limiter.limit("10 per minute")
def sensitive_endpoint():
    # Protected endpoint
    pass

import jwt
from datetime import datetime, timedelta
from functools import wraps

JWT_SECRET = 'your-256-bit-secret'  # Use environment variable
JWT_ALGORITHM = 'HS256'

def generate_access_token(user_id):
    payload = {
        'sub': user_id,
        'iat': datetime.utcnow(),
        'exp': datetime.utcnow() + timedelta(minutes=15),
        'type': 'access',
        'jti': str(uuid.uuid4())  # Unique token ID for revocation
    }
    return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)

def generate_refresh_token(user_id):
    payload = {
        'sub': user_id,
        'iat': datetime.utcnow(),
        'exp': datetime.utcnow() + timedelta(days=7),
        'type': 'refresh',
        'jti': str(uuid.uuid4())
    }
    return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)

def token_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        token = request.headers.get('Authorization', '').replace('Bearer ', '')
        if not token:
            return jsonify({'error': 'Token missing'}), 401

        try:
            payload = jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGORITHM])
            if payload['type'] != 'access':
                return jsonify({'error': 'Invalid token type'}), 401
            # Check if token is revoked
            if is_token_revoked(payload['jti']):
                return jsonify({'error': 'Token revoked'}), 401
        except jwt.ExpiredSignatureError:
            return jsonify({'error': 'Token expired'}), 401
        except jwt.InvalidTokenError:
            return jsonify({'error': 'Invalid token'}), 401

        return f(*args, **kwargs)
    return decorated

import logging
import json
from datetime import datetime, timezone

class SecurityLogger:
    def __init__(self, app=None):
        self.logger = logging.getLogger('security')
        handler = logging.FileHandler('security.log')
        handler.setFormatter(logging.Formatter('%(message)s'))
        self.logger.addHandler(handler)
        self.logger.setLevel(logging.INFO)

    def log_event(self, event_type, user_id=None, details=None, severity='INFO'):
        event = {
            'timestamp': datetime.now(timezone.utc).isoformat(),
            'event_type': event_type,
            'user_id': user_id,
            'ip_address': request.remote_addr,
            'user_agent': request.headers.get('User-Agent'),
            'details': details or {},
            'severity': severity
        }
        self.logger.info(json.dumps(event))

    def log_auth_success(self, user_id):
        self.log_event('AUTH_SUCCESS', user_id, severity='INFO')

    def log_auth_failure(self, user_id, reason):
        self.log_event('AUTH_FAILURE', user_id, {'reason': reason}, severity='WARNING')

    def log_access_denied(self, user_id, resource):
        self.log_event('ACCESS_DENIED', user_id, {'resource': resource}, severity='WARNING')

    def log_data_change(self, user_id, action, table, record_id):
        self.log_event('DATA_CHANGE', user_id, {
            'action': action,
            'table': table,
            'record_id': record_id
        }, severity='INFO')

security_logger = SecurityLogger()

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/Yelp/detect-secrets
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

  - repo: https://github.com/PyCQA/bandit
    hooks:
      - id: bandit
        args: ['-c', 'pyproject.toml']
        additional_dependencies: ['bandit[toml]']

  - repo: https://github.com/pre-commit/mirrors-eslint
    hooks:
      - id: eslint
        args: ['--fix']

# GitHub Actions security pipeline
name: Security Checks
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run SAST
        uses: github/codeql-action/analyze@v2

      - name: Run dependency check
        run: |
          pip install safety
          safety check -r requirements.txt

      - name: Run secrets scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

      - name: Run container scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'