Skip to main content

Security and accessibility from the start

Security protects people and their data. Accessibility allows more people actually use the service. It's not two steps to add at the end of a project.

Safety reflexes​

  • never place a secret key in the code sent to the browser;
  • validate the data on the server side, even if the form already controls them;
  • apply the principle of least privilege;
  • update dependencies and check their alerts;
  • use HTTPS and explicit access rules;
  • collect only the necessary data.

Accessibility reflexes​

  • use a button for an action and a link for navigation;
  • associate each field with a visible label;
  • keep a logical order of titles;
  • make the keyboard focus visible;
  • do not transmit information only by color;
  • provide a text alternative to useful images.
<label for="email">Adresse e-mail</label>
<input id="email" name="email" type="email" autocomplete="email">

This wording helps screen readers, but also people who use a small screen or who simply need a clearer interface.

Quick challenge​

Browse a page without a mouse. Can you achieve every action, understand where is the focus and going back without trap? Then note the data actually collected by this page and justify each of them.