OWASP Top 10 Explained with Practical Examples

You've built a web application, and now you're worried about security. The OWASP Top 10 is the go-to list of critical web application security risks. But reading the list is one thing; understanding how these risks manifest in real code is another. This article walks through each OWASP Top 10 category with practical examples and concrete steps to mitigate them.

1. Broken Access Control

Broken access control occurs when users can act outside their intended permissions. For example, a user might access another user's account by changing a URL parameter.

// Vulnerable: No check if the requested user ID belongs to the authenticated user
app.get('/api/user/:id', (req, res) => {
  const user = getUserById(req.params.id);
  res.json(user);
});

Mitigation: Enforce access control checks on the server side. Use role-based or attribute-based access control and deny by default.

2. Cryptographic Failures

Sensitive data like passwords and credit card numbers must be encrypted in transit and at rest. Using weak algorithms or hardcoding secrets are common pitfalls.

# Vulnerable: Using MD5 for password hashing
import hashlib
hash = hashlib.md5(password.encode()).hexdigest()

Mitigation: Use strong, salted hashing algorithms like bcrypt or Argon2. Always use HTTPS (TLS) for data in transit.

3. Injection

Injection flaws, such as SQL injection, occur when untrusted data is sent to an interpreter as part of a command or query.

// Vulnerable: String concatenation in SQL query
$sql = "SELECT * FROM users WHERE username = '" . $_GET['username'] . "'";

Mitigation: Use parameterized queries or prepared statements. Never concatenate user input directly into queries.

4. Insecure Design

Insecure design refers to missing or ineffective control design. For instance, a password recovery system that reveals whether an email exists can aid attackers.

Mitigation: Threat modeling during design, use secure design patterns, and implement rate limiting and other controls.

5. Security Misconfiguration

This includes leaving default accounts enabled, displaying stack traces to users, or misconfiguring cloud storage permissions.

# Vulnerable: Debug mode enabled in production
DEBUG = True

Mitigation: Harden configurations, remove unused features, and automate configuration checks.

6. Vulnerable and Outdated Components

Using libraries with known vulnerabilities is like leaving a door open. For example, an outdated version of a popular library might have a remote code execution flaw.

Mitigation: Regularly update dependencies, use tools like OWASP Dependency-Check, and monitor for CVEs.

7. Identification and Authentication Failures

Weak authentication allows attackers to guess passwords or hijack sessions.

// Vulnerable: No account lockout after failed attempts
if (passwordMatches) {
  loginUser();
} else {
  // just show error, no rate limiting
}

Mitigation: Implement multi-factor authentication, enforce strong password policies, and use secure session management.

8. Software and Data Integrity Failures

This category includes using untrusted sources for software updates or deserializing untrusted data.

// Vulnerable: Deserializing untrusted data
$data = unserialize($_POST['data']);

Mitigation: Verify digital signatures, use integrity checks, and avoid deserializing untrusted data.

9. Security Logging and Monitoring Failures

Without proper logging, breaches go undetected. For example, failing to log failed login attempts.

Mitigation: Log security-relevant events, set up alerts, and have an incident response plan.

10. Server-Side Request Forgery (SSRF)

SSRF occurs when an attacker can make the server send requests to unintended locations.

// Vulnerable: Fetching URL from user input without validation
fetch(req.query.url).then(...)

Mitigation: Validate and sanitize URLs, use allowlists, and restrict server permissions.

Comparison Table

FAQ

What is the OWASP Top 10?

The OWASP Top 10 is a regularly updated list of the most critical web application security risks, published by the Open Web Application Security Project (OWASP).

How often is the OWASP Top 10 updated?

It is updated periodically to reflect emerging threats and changes in technology. The last major update was in 2021.

Is the OWASP Top 10 enough for security?

No, it's a starting point. A comprehensive security program includes secure coding practices, regular testing, and continuous monitoring.

To further secure your applications, consider using tools like the Nginx Log Analyzer to monitor and detect suspicious activities in your server logs.