OWASP Top 10

The OWASP Top 10 is a list of the most common and dangerous security risks for web applications. If you're building a website or an app, you need to know these risks to keep your system safe.

---

1. Broken Access Control (A01)

This happens when users can access things they shouldn’t, like admin pages or other users' data.

Example:

Imagine a normal user visiting:

https://example.com/admin

If they see admin pages, that’s broken access control.

How to Fix:

• Use Authorization to check who can access what.
• Add Role-Based Access Control (RBAC): e.g., Admin, User, Guest.
• Use Secure Cookies.
• Always validate inputs on the backend.

---

2. Cryptographic Failures (A02)

This happens when sensitive data like passwords or credit card info isn’t protected properly.

Example:

Storing passwords as plain text:

Password: mypassword123

If a hacker gets this, it’s game over.

How to Fix:

• Use strong encryption for passwords like bcrypt.
• Use HTTPS/TLS to secure data during transfer.
• Example:

   const bcrypt = require('bcrypt');
   const hashedPassword = await bcrypt.hash("mypassword123", 10);
   console.log(hashedPassword);

---

3. Injection (A03)

This happens when a hacker sends harmful code (like SQL or scripts) into your application.

Example:

If your website takes input like this:

SELECT * FROM users WHERE id = 1;

A hacker could type:

1; DROP TABLE users;

How to Fix:

• Validate and sanitize all inputs.
• Use parameterized queries. Example in Node.js:

   const query = "SELECT * FROM users WHERE id = ?";
   db.query(query, [userId]);

---

4. Insecure Design (A04)

This happens when your system is not designed securely in the first place.

Example:

An app that allows weak passwords like "1234" is insecure by design.

How to Fix:

• Use OWASP resources to follow secure design patterns.
• Perform regular security reviews.

---

5. Security Misconfiguration (A05)

This happens when your app has default settings or unnecessary features enabled.

Example:

Leaving the default username and password:

admin / admin123

How to Fix:

• Keep systems up-to-date.
• Remove unused features and accounts.
• Use safe error messages like "Invalid credentials" instead of exposing details.

---

6. Vulnerable and Outdated Components (A06)

This happens when your app uses old software or libraries with known security issues.

Example:

Using an old version of a library like express that has vulnerabilities.

How to Fix:

• Update your libraries and software regularly.
• Use security tools like npm audit to check for vulnerabilities.

---

7. Identification and Authentication Failures (A07)

This happens when attackers can bypass login systems.

Example:

Allowing weak passwords like "password123" or not locking accounts after failed logins.

How to Fix:

• Use strong authentication like JWT tokens.
• Store passwords securely.
• Protect against brute-force attacks.
• Example: Lock an account after 5 failed attempts.

---

8. Software and Data Integrity Failures (A08)

This happens when your software or data is tampered with during updates or transfers.

Example:

A hacker changes your app update to include malware.

How to Fix:

• Always verify updates with digital signatures.
• Use trusted sources for libraries.
• Keep everything up-to-date.

---

9. Security Logging and Monitoring Failures (A09)

This happens when you don’t track suspicious activities on your app.

Example:

If someone tries to log in 100 times and fails, and you don’t log or monitor it, you might miss a brute-force attack.

How to Fix:

• Add proper logging and monitoring.
• Use tools like Winston or ELK Stack.
• Example: Log failed login attempts:

   console.log(`Failed login attempt for user: ${username}`);

---

10. Server-Side Request Forgery (SSRF) (A10)

This happens when an attacker tricks your server into making a request to an internal system.

Example:

A hacker sends:

http://localhost/admin

If your app fetches this URL, it exposes internal data.

How to Fix:

• Validate all URLs before making requests.
• Don’t allow users to directly input URLs.
• Example: Use a whitelist of trusted URLs.

---

Acknowledgment: This document references information from OWASP, Foyjul Karim and ChatGPT.

---