Security - OWASP Top 10

What is OWASP?

The Open Web Application Security Project (OWASP) is a nonprofit organization focused on improving the security of software. It provides resources, tools, and best practices for developers to build secure applications.

OWASP Top 10

The OWASP Top 10 is a list of the most critical security risks to web applications.

Broken Access Control: Users can access data or perform actions they are not authorized to use.
Example: Changing /orders/123 to /orders/124 reveals another customer’s order.
Security Misconfiguration: Systems, frameworks, cloud services, or permissions are configured insecurely.
Example: Default passwords, public storage buckets, unnecessary services, or detailed error pages.
Software Supply Chain Failure: Security problems enter through dependencies, build systems, package repositories, or deployment pipelines.
Example: An application installs a compromised npm package.
Cryptographic Failures: Sensitive information is exposed because encryption is missing, weak, or incorrectly implemented.
Example: Storing passwords in plain text or sending personal information over HTTP.
Injection: Untrusted input is interpreted as a command or query.
Example: SQL injection caused by concatenating user input into a database query.
Insecure Design: The application’s architecture or business rules lack necessary security controls.
Example: A password-reset flow allows unlimited attempts and has no identity verification.
Authentication Failures: Login and session controls allow attackers to impersonate users.
Example: Weak passwords, predictable session tokens, or sessions that remain valid after logout.
Software or Data Integrity Failures: The application trusts software updates, plugins, serialized data, or CI/CD artifacts without verifying them.
Example: Installing an unsigned update from an untrusted source.
Security Logging and Alerting Failures: Important security events are not recorded, monitored, or acted upon.
Example: Thousands of failed login attempts occur without generating an alert.
Mishandling of Exceptional Conditions: Errors, unusual states, resource exhaustion, or failed operations are handled insecurely.
Example: A payment partially fails, but the system still marks the order as paid.