> Shouldn't this be taught as a 'no no' in WebDev 101? It kind of is, kind of isn't. Security approaches I have witnessed were always very cargo-culty. People

> Shouldn't this be taught as a 'no no' in WebDev 101? It kind of is, kind of isn't. Security approaches I have witnessed were always very cargo-culty. People were aware of the OWASP top 10 and the like and applied best practice recommendations they have read somewhere and were even written into internal project guidelines. But security was not applied holistically. For example passwords are passed off to a library that used scrypt properly. But hand-rolled session management used regular string comparison for the token, which obviously is unsafe. Similarly parameterized SQL queries were used instead string processing because that's the rule in the project documentation. But there were no rules about lucene queries and boom some devs started to do string processing on the queries again. And every time I have to fight to get sane password policies. In one case they wanted to block copy&paste events in the login forms "for security reasons", but that would have made things more difficult for people who actually use password managers. Of course not everyone is like that, it just that the 1-2 people who would know to spot such things are often tied up in organizational overhead and then things slip through reviews.