Desenvolvimento de um sistema web com autenticação segura e proteção de dados

Abstract

The growing use of web systems for processing personal data has made authentication and access-control failures among the leading causes of security incidents, requiring technical mechanisms able to meet the requirements of Brazil's personal data protection legislation as well. This study aimed to develop a web application structured as a service-oriented programming interface, implementing user authentication, access control and credential protection mechanisms, and to evaluate its implementation through systematic technical testing. The research, applied in nature and qualitative in approach, was carried out in three stages: a theoretical review of web application security, development of the interface for user management and authentication, and a technical evaluation of the implemented mechanisms through manual tests performed with a request-testing tool and an automation script. The results indicated, in the aspects verified, that the application aligns with internationally recommended practices for web application security and with the technical security principles established in Brazilian data protection legislation, while also identifying specific gaps, such as the absence of rate limiting on repeated login attempts and partial input validation in some application modules. It is concluded that the implemented mechanisms meet information-security technical requirements relevant to legal compliance, although governance aspects and the standardization of input validation still require improvement in future versions of the application.