How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of solutions you can look up...but most of the time you don't even know there's an issue. Consider. I've been working on a website. I thought everything was solid - it uses HTTPS, the passwords are hashed, CORS is enabled for specific domains, the whole nine yards. Everything was locked up as tight as could be. Or so I thought. Then, as I was browsing the internet, I discovered CSRF. I did not know this was something I had to watch out for, so the website is vulnerable to it.
Now, I've been programming for many years. I've read quite a bit on security, took a university class on cryptography, and (IMO) understand quite a bit about threat models, hash functions, and so forth. If I can so easily fall prey to an (apparently common) security vulnerability, what hope does an average learned-programming-last-year kind of person stand? How does the internet work AT ALL? It seems like just when I know all the things I have to watch for, turns out there's another. And another. Not even NEW things, like Heartbleed, but things that have ALWAYS been dangerous cases. I'm pretty confident that it's possible in theory to be perfectly secure, but there are so many things you're just supposed to magically know that it's effectively infeasible to actually be secure.
My question boils down to: is there a list where, if I do all the things, I am guaranteed to be safe? (Assuming flawless libraries, browsers, and hosts, etc.)
Now, I realize there are varying levels of answer to this question: a stateless server that serves only public static content and is incapable of saving data is invulnerable to almost anything. If you want state, the list of things you must do increases. Therefore, a good answer should either give a list which covers all cases, or give several lists each of which secure a certain common set of capabilities. (Links to lists are allowed, and perhaps even preferred.)