Stop 05 · Vulnerabilities & OWASP Top 10Topics · 1/11

OWASP Top 10 Overview

In short

Most web breaches come from the same small set of mistakes. The OWASP Top 10 names them, so defenders, developers and auditors all talk about risk in one shared language.

The most widely referenced list of critical web application security risks, updated periodically by the Open Web Application Security Project — the standard starting point for understanding common web vulnerabilities.

The blob in a pilot's cap and jacket checks the wheel of a small light-blue propeller plane.

Think of it like this

The pilot's pre-flight checklist

Even a pilot with 10,000 hours walks around the plane before take-off: tyres, flaps, fuel, engine. Not because they forgot how to fly, but because the same few things cause most accidents. The OWASP Top 10 is that walk-around for a web app.

Watch it happen

The 2021 list, one risk at a time

Access

Crypto

Injection

Design

Config

Old deps

Auth

Integrity

Logging

SSRF

1/6OWASP, a non-profit community, ranks ten risk categories from real breach and testing data. This is the 2021 edition.

The big ideas

What you need to know

Categories, not bugs

Each entry groups many related weaknesses. Read the entry page for its causes, examples and prevention advice.

Check the edition

OWASP refreshes the list every few years. Always look up the current edition on owasp.org before quoting it.

A shared language

Developers, testers, auditors and managers use these names in tickets, reports and job interviews. Learn them by heart.

A floor, not a ceiling

Covering the Top 10 is the minimum. For deeper checks, OWASP ASVS gives a detailed requirement list.

See it in code

Walk through the code

text

1Pull request security checklist2[ ] Who can call this route? Is ownership checked on the server?3[ ] Does any input reach SQL, a shell, a file path or a URL fetch?4[ ] Are outputs encoded for HTML, and is CSP on?5[ ] Are secrets out of the code and debug mode off?6[ ] Did npm audit pass with no high or critical issues?7[ ] Are failed logins and denied requests logged?

1/3Access control first, because it is the most common category. Hiding a button is not a check.

A short checklist in your PR template turns the Top 10 from a poster on the wall into a habit on every merge.

Save yourself the pain

Common mistakes

Oops

Memorising the ten names for an interview and stopping there.

Do this instead

For each category, be able to explain one real example and one concrete fix.

Oops

Treating the Top 10 as a complete security standard for an audit.

Do this instead

It's an awareness list. Use OWASP ASVS or your company's standard for a full checklist.

Your mission

Map a training app to the Top 10

~40 min

Quick check

A teammate says, "We covered the OWASP Top 10, so the app is secure." What's the best reply?

Go deeper

1Read the current OWASP Top 10 list and note which categories are new versus longstanding.
2Learn why this list is treated as a baseline, not a complete security checklist.
3Preview the rest of this phase, which covers several Top 10 categories in depth.