| Understand Drupal's security layers |
Security Overview |
| Map OWASP Top 10 to Drupal |
OWASP Top 10 in Drupal |
| Implement access control on routes |
Access System Architecture |
| Define permissions and roles |
Permissions and Roles |
| Add access checks to routes |
Route Access Checks |
| Return access results correctly |
AccessResult Patterns |
| Control entity access |
Entity Access Control |
| Implement node grants |
Content Access (Node Grants) |
| Prevent XSS attacks |
XSS Prevention |
| Use Twig safely |
Twig Autoescape and Safe Markup |
| Prevent SQL injection |
SQL Injection Prevention |
| Protect against CSRF |
CSRF Protection |
| Validate and sanitize input |
Input Validation and Sanitization |
| Configure authentication |
Authentication System |
| Manage sessions securely |
Session Management |
| Use trusted callbacks |
Trusted Callbacks |
| Set security headers |
Security Headers (CSP, CORS) |
| Secure file uploads |
File Upload Security |
| Follow security best practices |
Best Practices and Patterns |
| Avoid common mistakes |
Anti-Patterns and Common Mistakes |
| Find security code references |
Code Reference Map |