Stop 13 · SecurityTopics · 1/12

OWASP Top 10

In short

Most hacks are not movie-style genius. They are the same handful of boring mistakes, repeated in app after app. OWASP keeps the list, so you can check yours first.

The industry-standard list of the ten most critical web application security risks, maintained by the Open Web Application Security Project — the baseline checklist every backend developer should know.

The blob, dressed as a society guard, checks a door lock and an open window with a clipboard in hand.

Think of it like this

The society guard's night checklist

A good watchman doesn't guess. He walks the same round every night: main gate locked, terrace door shut, lift key removed, CCTV on. Thieves mostly use those same few gaps. OWASP Top 10 is that round for web apps.

Watch it happen

Where most real attacks get in

OWASP Top 10

Access control

Injection

Misconfiguration

Old packages

Auth failures

1/6OWASP is a non-profit that studies real breaches and groups the common causes into ten categories.

The big ideas

What you need to know

A checklist, not a rulebook

It names categories of risk. Each one links to causes, examples and fixes you can apply to your own code.

Access control tops the charts

Checking that a user is logged in is not enough. Check that this record belongs to this user, on every request.

It gets updated

OWASP revises the list every few years from fresh breach data, so read the current edition, not a blog post from 2017.

Use it in code review

Before merging a new endpoint, walk the list: who can call this, what input reaches the database, what leaks in errors?

See it in code

Walk through the code

1// Broken: any logged-in user can read any order2app.get("/orders/:id", requireLogin, async (req, res) => {3  const order = await db.order.findUnique({ where: { id: req.params.id } });4  res.json(order);5});6 7// Fixed: the order must also belong to the caller8app.get("/orders/:id", requireLogin, async (req, res) => {9  const order = await db.order.findFirst({10    where: { id: req.params.id, userId: req.user.id },11  });12  if (!order) return res.status(404).json({ error: "Not found" });13  res.json(order);14});

1/3requireLogin only proves who you are. Any id in the URL is fetched, so changing 42 to 43 shows someone else's order.

This bug is called IDOR (insecure direct object reference). It's the most common access control hole in student projects and real startups alike.

Save yourself the pain

Common mistakes

Oops

Hiding the admin button in the frontend and calling it secure.

Do this instead

Anyone can call your API with curl. Check roles and ownership on the server for every protected route.

Oops

Treating the Top 10 as a one-time checklist before launch.

Do this instead

Revisit it whenever you add a feature. New endpoints bring new holes.

Your mission

Hunt for an IDOR in your own project

~30 min

Quick check

Your API checks the JWT on GET /invoices/:id but nothing else. Which OWASP category is this?

Go deeper

1Read through the current OWASP Top 10 list and note which risks apply to your projects.
2Pick one risk, e.g. broken access control, and audit a project against it specifically.
3Revisit this list periodically — the rankings shift as attack patterns evolve.