owasp-top-10

OWASP Top 10:2025

When NOT to Use This Skill

• OWASP Top 10:2021 - Use owasp skill for 2021 version
• Detailed secrets management - Use secrets-management skill
• Detailed supply chain security - Use supply-chain skill for in-depth dependency management
• License compliance - Use license-compliance skill

Deep Knowledge: Use mcp__documentation__fetch_docs with technology: owasp for comprehensive documentation.

Quick Reference

Rank	Category	Prevention
A01	Broken Access Control	Authorization checks, deny by default
A02	Security Misconfiguration	Hardening, security headers, no defaults
A03	Supply Chain Failures	Dependency audits, lockfiles, SBOMs
A04	Cryptographic Failures	Strong algorithms, proper key management
A05	Injection	Parameterized queries, input validation
A06	Insecure Design	Threat modeling, secure patterns
A07	Authentication Failures	MFA, rate limiting, secure sessions
A08	Integrity Failures	Signed updates, safe deserialization
A09	Logging Failures	Audit logs, alerting, monitoring
A10	Exception Handling	Graceful errors, no info leakage

A01: Broken Access Control

// Always verify ownership
if (resource.userId !== currentUser.id) {
  throw new ForbiddenException();
}

// Deny by default
const allowed = permissions.includes(requiredPermission);
if (!allowed) throw new ForbiddenException();

// Rate limit sensitive endpoints
app.use('/api/admin/*', adminRateLimiter);

A02: Security Misconfiguration

// Security headers
import helmet from 'helmet';
app.use(helmet());

// Strict CORS
app.use(cors({
  origin: ['https://myapp.com'],
  credentials: true
}));

// Hide errors in production
if (process.env.NODE_ENV === 'production') {
  app.use((err, req, res, next) => {
    res.status(500).json({ error: 'Internal error' });
  });
}

A03: Supply Chain Failures (NEW in 2025)

# Audit dependencies
npm audit
pip-audit
mvn dependency-check:check

# Use lockfiles
npm ci  # Instead of npm install

# Verify package integrity
npm install --ignore-scripts
npm config set ignore-scripts true

A04: Cryptographic Failures

// Strong password hashing
import { hash, verify } from 'argon2';
const hashed = await hash(password, { type: argon2id });

// Secure random
import { randomBytes, randomUUID } from 'crypto';
const token = randomBytes(32).toString('hex');

// AES-256-GCM for encryption (not CBC)

A05: Injection

// SQL - use parameterized queries
const user = await prisma.user.findUnique({ where: { id } });
await db.query('SELECT * FROM users WHERE id = $1', [id]);

// Command - use execFile, not exec
import { execFile } from 'child_process';
execFile('ls', ['-la', safeArg]);

// XSS - sanitize HTML
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(userInput);

A06: Insecure Design

Key practices:

• Threat modeling during design phase
• Secure design patterns (fail-safe, defense in depth)
• Security requirements in user stories
• Abuse case testing

A07: Authentication Failures

// Rate limiting
import rateLimit from 'express-rate-limit';
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5
});

// Secure cookies
res.cookie('session', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict'
});

// Strong passwords (12+ chars, mixed)

A08: Integrity Failures

// Verify signatures on updates
// Use subresource integrity (SRI)
<script src="lib.js"
  integrity="sha384-..."
  crossorigin="anonymous">
</script>

// Safe deserialization
// Avoid: JSON.parse(untrusted)
// Use: zod/yup validation

A09: Logging & Alerting Failures

// Log security events
logger.warn({
  event: 'auth_failure',
  userId: attemptedId,
  ip: req.ip,
  timestamp: new Date().toISOString()
});

// Events to log:
// - Login success/failure
// - Password changes
// - Permission denied
// - Rate limit exceeded

A10: Exception Handling (NEW in 2025)

// Graceful error handling
try {
  await riskyOperation();
} catch (error) {
  logger.error({ error, context });
  // Generic response to user
  throw new InternalServerException('Operation failed');
}

// Never expose stack traces
// Never expose internal paths
// Never expose SQL/DB errors

Security Scanning Commands

# Dependencies
npm audit --json
snyk test

# Secrets
gitleaks detect
trufflehog git file://.

# SAST
semgrep --config=p/security-audit .

# Docker
trivy image myimage:latest

Checklist

Risk	Prevention
SQL Injection	Parameterized queries, ORMs
XSS	Escape output, CSP headers
CSRF	CSRF tokens, SameSite cookies
Auth issues	MFA, rate limiting, secure sessions
Secrets	Environment variables, vaults
Supply chain	Audit, lockfiles, SBOMs

Anti-Patterns

Anti-Pattern	Why It's Bad	Correct Approach
Checking permissions in frontend only	Client-side bypass (A01)	Always verify on backend
Using weak crypto (MD5, DES)	Easily broken (A04)	Use AES-256-GCM, argon2, SHA-256+
npm install in CI/CD	Non-deterministic builds (A03)	Use npm ci with lockfiles
Catching all exceptions silently	Hides security issues (A10)	Log errors, fail gracefully
Trusting user input in queries	Injection attacks (A05)	Always use parameterized queries
No session timeout	Session hijacking (A07)	Implement idle + absolute timeout

Quick Troubleshooting

Issue	Likely Cause	Solution
npm audit shows vulnerabilities	Outdated dependencies (A03)	Run npm audit fix or update manually
Login always fails after 5 attempts	Rate limiter too strict (A07)	Review rate limit settings
Secrets leaked in git history	Committed .env file (A02)	Use BFG to clean history, rotate secrets
Database queries slow/failing	SQL injection attack (A05)	Review logs, switch to parameterized queries
Users accessing others' data	Missing authorization (A01)	Add ownership checks in all endpoints
Stack traces in production	Exception handling disabled (A10)	Enable production error handling

Related Skills

• Supply Chain Security
• Secrets Management
• JWT Security