The OWASP Top 10 tour
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
know the main risk categories and a backend example for each.
Planned topics
- OWASP (a non-profit) publishes a Top 10 list of the most serious web application risks, updated every few years.
- Typical categories: broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, integrity failures, logging and monitoring failures, SSRF. Names and order change by edition, so verify.
- Broken access control is at or near the top: for example an IDOR.
- OWASP also has an API Security Top 10 that fits our work well.
- Use the list as a checklist for code reviews.
Draft outline details
Demonstration
a table: category / Shop example / control.
Check your understanding
Which category does "customer A reads customer B's order" belong to?
Show answer
Broken access control.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.