security-review

Security Review

OWASP Top 10 (2021)

Use this as a baseline checklist when reviewing any application for security vulnerabilities.

A01: Broken Access Control

Users acting outside their intended permissions.

// VULNERABLE: No authorization check
app.get('/api/users/:id', async (req, res) => {
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
  res.json(user);
});

// FIXED: Verify the requesting user has permission
app.get('/api/users/:id', authenticate, async (req, res) => {
  if (req.user.id !== req.params.id && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);
  res.json(user);
});

A02: Cryptographic Failures

• Use TLS 1.2+ for all data in transit. Hash passwords with bcrypt (cost 12+) or argon2.
• Never use MD5 or SHA-1 for password hashing. Encrypt data at rest with AES-256-GCM.

A03: Injection

# VULNERABLE: SQL injection via string concatenation
cursor.execute(f"SELECT * FROM users WHERE name = '{user_input}'")

# FIXED: Parameterized query
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))

A04: Insecure Design

• Rate limit authentication endpoints. Use CAPTCHA for public forms.
• Apply least privilege. Threat model before building, not after.

A05: Security Misconfiguration

• Disable directory listing. Remove default credentials and demo accounts.
• Disable verbose errors in production. Review cloud IAM policies.

A06: Vulnerable and Outdated Components

npm audit          # Node.js
pip-audit          # Python
bundle audit       # Ruby

A07: Identification and Authentication Failures

• Enforce strong password policies (length over complexity). Account lockout after repeated failures.
• MFA for sensitive operations. Invalidate sessions on logout and password change.

A08: Software and Data Integrity Failures