Step-by-step articles on OWASP Top 10, part of our Application Security collection.
Showing 10 articles
The OWASP Top 10 is a widely used awareness list of the most critical web application security risks, based on data from real applications. It's updated every few years; the 2025 edition reflects how modern apps are built, with supply chains and cloud configur...
Broken access control means a user can do something they shouldn't be allowed to. The most common form is IDOR (insecure direct object reference): change an ID in a request and see someone else's data. The vulnerable pattern // GET /api/invoices/1043 app.get('...
SQL injection happens when user input is pasted into a SQL string, letting an attacker change the query itself. It's old, well understood and still found in production code. The vulnerability // email comes from a login form const sql = `SELECT * FROM users WH...
Cross-site scripting (XSS) lets an attacker run their JavaScript in other users' browsers on your site. With it they can read data on the page, act as the user, or steal tokens kept in JavaScript-accessible storage. How it happens // A comment saved as: <img s...
Cross-site request forgery (CSRF) tricks a logged-in user's browser into sending a request to your site from another site. Because browsers attach cookies automatically, the request arrives with the victim's session. The attack <!-- on evil.example --> <form a...
Many features fetch a URL on the user's behalf: link previews, "import from URL", webhooks, PDF generators. If an attacker controls the URL, they can make your server request internal addresses it can reach but they can't. That's server-side request forgery ....
Many breaches don't need a clever exploit, just a setting left at the wrong value. Security misconfiguration is consistently near the top of the OWASP list. 1. Send security headers Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Securit...
A typical JavaScript or Python app runs far more third-party code than first-party code. Attackers know this: compromised maintainer accounts, typosquatted packages and poisoned build pipelines have all hit popular ecosystems, including several high-profile np...
Cryptographic failures are rarely about breaking strong maths. They're about not encrypting data at all, using the wrong tool, or handling keys carelessly. 1. Passwords: hash, never encrypt import argon2 from 'argon2'; const hash = await argon2.hash(password,...
Two related OWASP risks are about what happens when things go wrong: whether your app fails safely, and whether anyone notices an attack in progress. Fail closed When an error happens during a security decision, the safe default is "deny". // Dangerous: an err...
