Security Architecture Principles

Build security into the structure, not as an afterthought.

Defense in Depth

Multiple layers, not single points of failure:

Request → Rate Limit → Auth → Validation → Sanitization → Query → Response
          (layer 1)   (2)      (3)           (4)          (5)

If one layer fails, others still protect. Never rely on a single check.

Least Privilege

Minimum necessary permissions only:

// ❌ Bad: Admin access for everything
const db = connectAsAdmin();
 
// ✅ Good: Scoped access
const db = connectAsReadOnly();  // for queries
const db = connectWithWriteScope(['users']);  // for specific writes

Apply to:

Database connections
API keys
User roles
File system access
Network access

Fail Secure

Default to deny, not allow:

// ❌ Bad: Allow unless explicitly denied
if (!user.isBanned) { 
  allowAccess(); 
}
 
// ✅ Good: Deny unless explicitly allowed
if (user.hasPermission('read:posts')) { 
  allowAccess(); 
}
else {
  denyAccess();  // Explicit denial
}

Input/Output Discipline

Validate ALL Inputs

// Never trust user data
const schema = z.object({
  email: z.string().email(),
  age: z.number().min(0).max(150),
  name: z.string().max(100).regex(/^[a-zA-Z\s]+$/)
});
 
const validated = schema.parse(userInput);

Encode ALL Outputs

// Prevent XSS
const safeHtml = escapeHtml(userContent);
 
// In React, this is automatic for {}
<div>{userContent}</div>  // Safe
 
// But not for dangerouslySetInnerHTML
<div dangerouslySetInnerHTML={{__html: userContent}} />  // UNSAFE

Sanitize Before Storage AND Display

// Before storing
const cleanInput = sanitize(userInput);
await db.save(cleanInput);
 
// Before displaying (belt and suspenders)
const safeOutput = escapeHtml(storedContent);

Architecture Diagram

┌─────────────────────────────────────────────────────┐
│                    INTERNET                         │
└─────────────────────┬───────────────────────────────┘
                      │
┌─────────────────────▼───────────────────────────────┐
│  LAYER 1: Edge / CDN / WAF                         │
│  - DDoS protection                                  │
│  - Basic filtering                                  │
└─────────────────────┬───────────────────────────────┘
                      │
┌─────────────────────▼───────────────────────────────┐
│  LAYER 2: Load Balancer / Rate Limiter             │
│  - Request limits                                   │
│  - IP blocking                                      │
└─────────────────────┬───────────────────────────────┘
                      │
┌─────────────────────▼───────────────────────────────┐
│  LAYER 3: Application                              │
│  - Authentication                                   │
│  - Authorization                                    │
│  - Input validation                                 │
│  - Business logic                                   │
└─────────────────────┬───────────────────────────────┘
                      │
┌─────────────────────▼───────────────────────────────┐
│  LAYER 4: Data                                     │
│  - Encrypted at rest                               │
│  - Access controls                                  │
│  - Audit logging                                    │
└─────────────────────────────────────────────────────┘

Security Mindset Cost Control