Security is a property of the whole request path. Start with a small set of controls that prevent common failures, then make each trust decision explicit:
- Encrypt data in transit and at rest.
- Use parameterized queries or prepared statements to prevent SQL injection.
- Encode output for its destination context to prevent cross-site scripting (XSS).
- Treat input validation as a useful additional check, not the primary SQL injection or XSS defense.
- Grant each identity only the permissions it needs, following least privilege.
- Edge and proxy
The edge can provide CDN, WAF, and DDoS controls; a proxy can terminate TLS and enforce configured rate limits.
- HTTP boundary
An API gateway or middleware applies authentication, CORS policy, and security headers.
- Application
Authorize each action and validate its input.
- Database
Use parameterized queries and least-privilege access. None of these layers replaces object-level authorization.
Defense in depth assigns different jobs to different controls.
How to read this model
A guarded entry fixture with independent application and data latches. The object is a teaching analogy. Inspecting a part highlights its role; it does not execute or simulate the software. Cabinet trays are records, workpieces are data, and latches are checks. Unless an explanation states a quantity, compartments and sample workpieces do not denote data counts. Part dimensions are not a quantitative scale.
The edge can absorb denial-of-service traffic and reject known-bad requests. A reverse proxy can terminate TLS and rate-limit clients. Middleware can authenticate a request and set security headers. The application must authorize each requested object, not only authenticate the user. The database must enforce least-privilege credentials and protect stored data.
Authentication answers "who is this?" Authorization answers "may this identity perform this action on this object?" Keep those decisions separate. An authenticated user can still request another user's record. See the backend security deep dive for injection, authentication, authorization, XSS, CSRF, and misconfiguration.