/owasp — OWASP Security Standards

Apply OWASP (Open Web Application Security Project) guidelines: the industry standard for web application security.

OWASP Top 10 (2021)

A01: Broken Access Control

// BAD: No authorization check
[HttpGet("/api/users/{id}")]
public User GetUser(int id) => _db.Users.Find(id);

// GOOD: Verify ownership
[HttpGet("/api/users/{id}")]
[Authorize]
public User GetUser(int id) {
    var user = _db.Users.Find(id);
    if (user.Id != CurrentUserId && !IsAdmin)
        throw new ForbiddenException();
    return user;
}

A02: Cryptographic Failures

• •Use TLS 1.2+ for all traffic
• •Hash passwords with bcrypt/Argon2 (never MD5/SHA1)
• •Encrypt sensitive data at rest (AES-256)
• •Never hardcode secrets

A03: Injection

// BAD: SQL Injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// GOOD: Parameterized query
const query = 'SELECT * FROM users WHERE id = @id';
await db.query(query, { id: userId });

A04: Insecure Design

• •Threat model before coding
• •Use secure design patterns
• •Limit resource consumption
• •Separate tenants properly

A05: Security Misconfiguration

• •Remove default credentials
• •Disable directory listing
• •Remove unused features/frameworks
• •Keep dependencies updated
• •Review cloud permissions

A06: Vulnerable Components

# Check for vulnerabilities
npm audit
dotnet list package --vulnerable

A07: Authentication Failures

• •Multi-factor authentication
• •Rate limit login attempts
• •Secure password recovery
• •Session timeout
• •Secure session tokens

A08: Software and Data Integrity Failures

• •Verify signatures on updates
• •Use integrity checks (SRI for CDN)
• •Secure CI/CD pipelines
• •Validate deserialized data

A09: Security Logging & Monitoring Failures

// Log security events
_logger.LogWarning("Failed login attempt for {User} from {IP}",
    username, Request.RemoteIp);
_logger.LogCritical("Privilege escalation attempt by {User}",
    CurrentUser.Id);

A10: Server-Side Request Forgery (SSRF)

// BAD: User controls URL
var response = await _http.GetAsync(userProvidedUrl);

// GOOD: Allowlist domains
if (!_allowedDomains.Contains(new Uri(url).Host))
    throw new SecurityException("Domain not allowed");

Security Checklist

Input Validation

• • All input validated server-side
• • Whitelist validation preferred
• • Parameterized queries for database
• • Output encoding for HTML/JS/URL

Authentication

• • Strong password policy enforced
• • Passwords hashed with bcrypt/Argon2
• • MFA available/required
• • Account lockout after failures
• • Secure session management

Authorization

• • Default deny policy
• • Role-based access control
• • Verify ownership on resources
• • Audit trail for sensitive actions

Data Protection

• • TLS for all traffic
• • Sensitive data encrypted at rest
• • No secrets in code/config
• • PII minimization

Error Handling

• • Generic error messages to users
• • Detailed errors only in logs
• • No stack traces exposed

When to Invoke /owasp

• •Implementing authentication/authorization
• •Processing user input
• •Handling sensitive data
• •Before security code review
• •Designing new API endpoints
• •Evaluating third-party dependencies