React App Security Checklist

Authentication Checks

Passwordless · MFA · Session Management

0/6

Implement passwordless authentication option (magic link, passkey/WebAuthn)

Reduce password-based attack vectors. Support FIDO2/WebAuthn for passkey login.

Enforce Multi-Factor Authentication (MFA) for all privileged accounts

TOTP, SMS OTP, or hardware keys. Enforce MFA for admin/editor roles at minimum.

Configure secure session management with short-lived JWT / refresh token rotation

Access token TTL ≤ 15 min. Refresh token rotation with reuse detection enabled.

Store tokens securely — avoid localStorage for sensitive tokens; prefer httpOnly cookies

httpOnly + Secure + SameSite=Strict cookies prevent XSS token theft.

Implement account lockout / brute-force protection on login endpoints

Rate limiting with exponential backoff. Lock after N failed attempts. CAPTCHA for suspicious patterns.

Validate identity token on every protected API request (not just initial login)

Never trust cached auth state alone. Re-validate token signature, expiry, and issuer server-side.

Authorization / Access Control

RBAC vs ABAC · Client + Server Enforcement

0/7

Define and document your access control model — RBAC, ABAC, or hybrid

RBAC: role-based (admin/editor/viewer). ABAC: attribute-based (department, clearance, time). Document role matrix explicitly.

Enforce authorization checks on the server side — never rely solely on React UI guards

Client-side route guards are UX convenience only. All resource access must be validated in the API layer.

Implement React route-level guards using ProtectedRoute components with role checks

Wrap sensitive routes with permission checks. Redirect unauthorized users to 403 page, not silently to login.

Apply principle of least privilege — users get minimum permissions needed for their role

Audit permission assignments regularly. Avoid wildcard grants. Scope API tokens to specific operations.

Prevent Insecure Direct Object Reference (IDOR) — validate resource ownership on every request

Never trust user-supplied resource IDs alone. Always verify the requesting user owns or has access to the resource.

Use feature flags or permission-aware rendering to conditionally show UI elements

Use usePermission() hooks or permission context. Don't just hide — ensure server blocks unauthorized actions too.

Test privilege escalation paths — ensure users cannot elevate their own permissions

Include horizontal and vertical privilege escalation in test cases. Automated tests for permission boundaries.

Non-Human Identity (NHI)

API Tokens · Service Accounts · Expiry Management

0/6

Inventory all API tokens, service accounts, and machine credentials in use

Maintain a living registry of all NHIs. Include owner, purpose, scope, creation date, and expiry.

Set mandatory expiration on all API tokens — no long-lived or permanent tokens in production

Max token lifetime: 90 days for service tokens, 1 year for CI/CD tokens with rotation policy defined.

Store API secrets in a secrets manager (Vault, AWS Secrets Manager, Doppler) — not in .env files

Never commit secrets to git. Use secret scanning tools (GitGuardian, gitleaks) in CI pipeline.

Scope service account permissions to minimum required — avoid admin-level service tokens

Each service should have its own identity with scoped permissions. Shared credentials are a security anti-pattern.

Implement automated token rotation and alerting for upcoming expiry (14-day pre-warning)

Use scheduled jobs or secrets manager rotation policies. Alert on-call team before production tokens expire.

Immediately revoke compromised or unused NHI credentials — maintain a revocation process

Define incident runbook for token compromise. Remove orphaned service accounts within 30 days of decommission.

Security Logging & Telemetry

Identity Telemetry · Access Attempt Logs · Audit Trail

0/7

Log all authentication events — login success, failure, logout, and MFA challenges

Include timestamp, user ID, IP address, device fingerprint, and result. Store in tamper-evident log store.

Log all authorization decisions — especially access denials and privilege escalation attempts

403 responses should generate structured audit log entries with full context. Never silently fail authorization.

Implement structured log format (JSON) with consistent identity telemetry fields across all services

Standard fields: userId, sessionId, requestId, action, resource, result, ip, userAgent.

Set up real-time alerts for suspicious access patterns (anomaly detection, repeated failures)

Alert on: 5+ failed logins/5min, access from new geolocation, off-hours admin actions, impossible travel detection.

Retain security logs for minimum 90 days (hot) + 1 year (cold storage) with access controls

Logs should be write-once or append-only. Restrict log access to security team. Align with compliance requirements (SOC2, GDPR).

Never log sensitive data — exclude passwords, tokens, PII, and payment info from log payloads

Use log scrubbing middleware. Mask or redact fields: password, token, ssn, cardNumber. Audit logging libraries for leaks.

Correlate frontend and backend logs using a shared request correlation ID (traceId)

Generate UUID at React app level, pass via X-Correlation-ID header, propagate through all microservices for full trace.

OWASP Alignment

Broken Auth · Broken Access Control · Logging Failures

0/7

A01 Broken Access Control — enforce deny-by-default at every API endpoint

OWASP #1 risk. All routes must require explicit permission grants. Fail securely — deny unless explicitly permitted.

A01 Disable directory listing and block access to metadata endpoints in production

Restrict access to /.env, /api/debug, /actuator. Remove debug endpoints before production deploy.

A07 Identification & Authentication Failures — verify all auth config against OWASP ASVS L2

Check against OWASP Application Security Verification Standard. Key areas: V2 (Auth), V3 (Session), V4 (Access Control).

A07 Prevent credential stuffing via device fingerprinting and behavior-based anomaly detection

Integrate with threat intelligence feeds. Block known compromised credential pairs via Have I Been Pwned API on registration.

A09 Security Logging Failures — ensure all security events are logged and monitored

OWASP A09:2021. Verify logging covers: auth events, high-value transactions, input validation failures, and system errors.

A09 Test incident response readiness — verify logs provide sufficient data for breach investigation

Run tabletop exercises. Can you answer: who accessed what, when, from where, and what did they change? Within 1 hour of incident.

A02 Cryptographic Failures — ensure tokens are signed with RS256/ES256, not HS256 in multi-tenant setups

Asymmetric signing (RS256) allows public key verification. Rotate signing keys regularly. Validate alg header — reject none algorithm.

Permission & Identity Security Checklist

Authentication Checks

Authorization / Access Control

Non-Human Identity (NHI)

Security Logging & Telemetry

OWASP Alignment