My question is: can I design and test it as if it were a regular application, and only later add everything that is necessary to protect it? Or should I check it over SSL from the start.
If on whatever is necessary to make it secure you mean enable ssl , then be sure to approach it. But if other things are needed for security, such as authentication, authorization, role-based access, and no, then no. The usual wisdom is to enable security at all stages of development, because you cannot just “enable it” at the end. Most of the problems with implementing a secure system with a rich set of access controls will not arise if you do not really test the basic functionality and are not limited to these controls, and you can also check both the “happy path” and the “Unlucky path” through the code .