owasp-security

Comprehensive OWASP Security Skills

A developer-focused security reference covering six OWASP standards for securing web applications, APIs, mobile apps, containers, and AI/LLM systems. Each section provides concise detection guidance, key requirements, and mitigation strategies.

Quick Navigation

1. OWASP Top 10 (2021)
2. OWASP ASVS 5.0
3. OWASP MASVS v2.1.0
4. OWASP API Security Top 10
5. OWASP Kubernetes Top 10
6. OWASP Agentic Applications 2026

---

Section 1: OWASP Top 10 (2021)

The OWASP Top 10 represents the most critical security risks in web applications.

A01: Broken Access Control

Detection: URLs with direct ID references (/user/1234/orders); client-side only enforcement; missing authorization checks. Mitigation: Enforce server-side authorization for every sensitive operation; verify user ownership of resources; implement default-deny principle. Example:

// INSECURE: No authorization check
app.get('/users/:id/orders', (req, res) => {
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});
// SECURE: Authorization check
app.get('/users/:id/orders', (req, res) => {
  if (req.user.id !== parseInt(req.params.id)) return res.status(403).json({error: 'Forbidden'});
  const orders = db.query('SELECT * FROM orders WHERE user_id = ?', req.params.id);
  res.json(orders);
});

Checklist: ☐ Authorization on server for all sensitive ops ☐ Default-deny policy ☐ No ID-based obscurity ☐ Whitelist allowed fields

---

A02: Cryptographic Failures

Detection: Sensitive data in plaintext; weak encryption (DES, ECB); missing TLS; hardcoded secrets in code. Mitigation: Always use HTTPS/TLS; encrypt data at rest with AES-256; store secrets in environment variables or vaults; mask sensitive logs. Example:

# INSECURE: API key in code
api_key = "sk-abc123xyz789"

# SECURE: From environment
import os
api_key = os.getenv("API_KEY")
if not api_key: raise ValueError("API_KEY not set")

Checklist: ☐ HTTPS enforced ☐ AES-256 encryption at rest ☐ No secrets in code ☐ Sensitive data masked in logs