~/blog / backend-security-checklist.md

A backend security checklist I actually use

Practical hardening for Django and FastAPI services: auth, secrets, uploads, dependencies, and the boring checks that stop most attacks.

2 min readsecurity, backend, django

Security work that survives is a checklist, not a speech. This is the one I run on any Django or FastAPI service, shaped by years of multi vendor marketplaces, recruiting platforms, and health data.

Transport and session#

  • HTTPS everywhere, HSTS on, secure and HttpOnly cookies, SameSite set deliberately.
  • SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURE, and Django's SECURE_SSL_REDIRECT in production settings.
  • Short session lifetime for anything that touches personal data.
settings.pypython
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_AGE = 60 * 60 * 8

Secrets and permissions#

Secrets live in the environment or a secret manager, never in the repository. Rotate on any suspected leak. Database roles get least privilege: the web role does not own the schema.

Input is hostile#

Validate everything at the boundary: uploads by magic byte and size cap, query parameters by schema, webhooks by signature with a constant time compare. Never interpolate user input into shell commands, PDF templates, or SQL.

Dependencies and delivery#

Pin dependencies, scan them in CI, and fail the build on known critical CVEs. One path from merge to deploy, with review required, so a malicious change cannot skip scrutiny. Backups get restored in practice, not on paper.

What this buys#

No checklist stops a determined attacker with a zero day. This one stops the realistic cases: session theft, leaked secrets, poisoned uploads, dependency surprises, and the unreviewed merge. Boring, repeatable, and cheap to keep running.

Need help building or upgrading a system?

I take on contract work, in English or French.

hamzakhchine@gmail.comSubscribe via RSS