Web Security OWASP Top 10 Complete Guide 2025: 10 Vulnerabilities Every Developer Must Prevent

# Attacker changes the ID in the URL to access another user's data
GET /api/users/12345/profile  -> own profile
GET /api/users/12346/profile  -> another user's profile (unauthorized!)

// Vulnerable - no ownership check
app.get('/api/users/:id/profile', async (req, res) => {
  const user = await User.findById(req.params.id);
  res.json(user); // Anyone with the ID can access!
});

// Vulnerable - role check but no resource ownership check
app.delete('/api/posts/:id', requireRole('user'), async (req, res) => {
  await Post.findByIdAndDelete(req.params.id); // Can delete others' posts!
  res.json({ message: 'Deleted' });
});

// Secure - ownership verification
app.get('/api/users/:id/profile', authenticate, async (req, res) => {
  if (req.params.id !== req.user.id && !req.user.isAdmin) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const user = await User.findById(req.params.id);
  res.json(user);
});

// Secure - ownership + role verification
app.delete('/api/posts/:id', authenticate, async (req, res) => {
  const post = await Post.findById(req.params.id);
  if (!post) return res.status(404).json({ error: 'Not found' });

  if (post.authorId !== req.user.id && !req.user.isAdmin) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  await post.deleteOne();
  res.json({ message: 'Deleted' });
});

// Vulnerable: MD5 for password hashing
const crypto = require('crypto');
const hashedPassword = crypto.createHash('md5').update(password).digest('hex');

// Vulnerable: hardcoded encryption key
const SECRET_KEY = 'my-super-secret-key-123';
const encrypted = encrypt(data, SECRET_KEY);

const bcrypt = require('bcrypt');

// Secure: bcrypt with auto-generated salt
const SALT_ROUNDS = 12;
const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
const isMatch = await bcrypt.compare(inputPassword, hashedPassword);

// Secure: load key from environment + AES-256-GCM
const crypto = require('crypto');
const SECRET_KEY = Buffer.from(process.env.ENCRYPTION_KEY, 'hex');

function encrypt(plaintext) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-gcm', SECRET_KEY, iv);
  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
  const tag = cipher.getAuthTag();
  return { iv: iv.toString('hex'), encrypted: encrypted.toString('hex'), tag: tag.toString('hex') };
}

// Secure: TLS 1.2+ only
const server = https.createServer({
  minVersion: 'TLSv1.2',
  ciphers: 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256',
});

-- Normal query
SELECT * FROM users WHERE username = 'admin' AND password = 'password123'

-- Attack input: username = ' OR '1'='1' --
SELECT * FROM users WHERE username = '' OR '1'='1' --' AND password = ''
-- Result: all user records returned!

// ===== SQL Injection =====

// Vulnerable: string concatenation
const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
db.query(query);

// Secure: parameterized query (Prepared Statement)
const query = 'SELECT * FROM users WHERE username = ? AND password = ?';
db.query(query, [username, hashedPassword]);

// Secure: ORM (Sequelize example)
const user = await User.findOne({
  where: { username, password: hashedPassword },
});

// ===== NoSQL Injection =====

// Vulnerable: user input directly in query
app.post('/login', async (req, res) => {
  const user = await User.findOne(req.body);
});

// Secure: type validation + mongo-sanitize
const sanitize = require('mongo-sanitize');
app.post('/login', async (req, res) => {
  const username = sanitize(req.body.username);
  if (typeof username !== 'string') return res.status(400).send('Invalid input');
  const user = await User.findOne({ username, password: hashedPassword });
});

// ===== OS Command Injection =====

// Vulnerable: user input in shell command
const { exec } = require('child_process');
exec(`ping ${userInput}`, callback);
// Attack: userInput = "8.8.8.8; rm -rf /"

// Secure: execFile (no shell interpretation)
const { execFile } = require('child_process');
execFile('ping', ['-c', '4', userInput], callback);

// ===== Stored XSS =====

// Vulnerable: raw user input in HTML
app.get('/comments', async (req, res) => {
  const comments = await Comment.find();
  let html = '';
  comments.forEach(c => {
    html += `<div>${c.text}</div>`; // XSS vulnerable!
  });
  res.send(html);
});

// Secure: output encoding
const he = require('he');
comments.forEach(c => {
  html += `<div>${he.encode(c.text)}</div>`;
});

// React auto-escapes JSX by default
function Comment({ text }) {
  return <div>{text}</div>; // Automatically HTML-escaped
}

// Principle 1: Rate Limiting
const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // max 5 attempts
  message: 'Too many login attempts. Please try again after 15 minutes.',
  standardHeaders: true,
});
app.post('/login', loginLimiter, loginHandler);

// Principle 2: Business Logic Validation
async function applyCoupon(userId, couponCode) {
  const coupon = await Coupon.findOne({ code: couponCode });
  if (!coupon || coupon.usedBy.includes(userId)) {
    throw new Error('Invalid or already used coupon');
  }
  // Atomic update to prevent race conditions
  const result = await Coupon.findOneAndUpdate(
    { code: couponCode, usedBy: { $ne: userId } },
    { $push: { usedBy: userId } },
    { new: true }
  );
  if (!result) throw new Error('Coupon already used');
  return result;
}

// Vulnerable: default settings
const app = express();
app.use(express.json());
// X-Powered-By header exposes "Express"

// Secure: Helmet middleware + hardening
const helmet = require('helmet');
const app = express();
app.use(helmet());
app.disable('x-powered-by');

// Secure: prevent error information disclosure
app.use((err, req, res, next) => {
  console.error(err.stack); // log server-side only
  res.status(500).json({
    error: 'Internal Server Error', // generic message only
  });
});

# Docker security configuration

# Vulnerable: running as root
FROM node:20
COPY . .
CMD ["node", "server.js"]

# Secure: non-root user
FROM node:20-slim
RUN groupadd -r appuser && useradd -r -g appuser appuser
WORKDIR /app
COPY --chown=appuser:appuser . .
USER appuser
CMD ["node", "server.js"]

# npm dependency audit
npm audit
npm audit fix

# Snyk vulnerability scanning
npx snyk test
npx snyk monitor

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    reviewers:
      - "security-team"

// ===== Vulnerable session management =====

// Vulnerable: sequential session IDs
let sessionCounter = 0;
function createSession() {
  return (++sessionCounter).toString(); // Predictable!
}

// Secure: cryptographically secure random session ID
const crypto = require('crypto');
function createSession() {
  return crypto.randomBytes(32).toString('hex'); // 256-bit random
}

// ===== Vulnerable JWT implementation =====

// Vulnerable: algorithm none allowed
const payload = jwt.verify(token, secret);

// Secure: explicit algorithm specification
const payload = jwt.verify(token, secret, {
  algorithms: ['HS256'],
  issuer: 'my-app',
  audience: 'my-api',
});

// ===== MFA Implementation =====
const speakeasy = require('speakeasy');

async function setupMFA(userId) {
  const secret = speakeasy.generateSecret({
    name: `MyApp:user-${userId}`,
    issuer: 'MyApp',
  });
  const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
  await User.updateOne({ _id: userId }, { mfaSecret: encrypt(secret.base32) });
  return { qrCodeUrl, backupCodes: generateBackupCodes() };
}

function verifyMFA(token, userSecret) {
  return speakeasy.totp.verify({
    secret: userSecret,
    encoding: 'base32',
    token: token,
    window: 1,
  });
}

// Vulnerable: deserializing user input directly
app.post('/api/data', (req, res) => {
  const data = JSON.parse(req.body.serializedData);
  processData(data);
});

// Secure: schema validation before deserialization
const Joi = require('joi');
const schema = Joi.object({
  name: Joi.string().max(100).required(),
  age: Joi.number().integer().min(0).max(150),
  email: Joi.string().email(),
});

app.post('/api/data', (req, res) => {
  const { error, value } = schema.validate(req.body);
  if (error) return res.status(400).json({ error: error.details });
  processData(value);
});

const winston = require('winston');

const securityLogger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  defaultMeta: { service: 'security' },
  transports: [
    new winston.transports.File({ filename: 'security.log' }),
  ],
});

function logAuthEvent(event) {
  securityLogger.info('Authentication event', {
    type: event.type,
    userId: event.userId,
    ip: event.ip,
    userAgent: event.userAgent,
    timestamp: new Date().toISOString(),
    // Never log passwords!
  });
}

function logAuditEvent(action, userId, resource, details) {
  securityLogger.info('Audit event', {
    action,
    userId,
    resource,
    details,
    timestamp: new Date().toISOString(),
  });
}

const axios = require('axios');
const { URL } = require('url');
const dns = require('dns').promises;
const ipaddr = require('ipaddr.js');

// Vulnerable: directly requesting user-supplied URL
app.post('/api/fetch-url', async (req, res) => {
  const response = await axios.get(req.body.url);
  res.json(response.data);
});

// Secure: URL validation + IP blocking
async function isUrlSafe(urlString) {
  const parsed = new URL(urlString);

  if (parsed.protocol !== 'https:') return false;

  const blockedHosts = ['localhost', '127.0.0.1', '0.0.0.0', 'metadata.google.internal'];
  if (blockedHosts.includes(parsed.hostname)) return false;

  const addresses = await dns.resolve4(parsed.hostname);
  for (const addr of addresses) {
    const ip = ipaddr.parse(addr);
    if (ip.range() !== 'unicast') return false;
  }
  return true;
}

app.post('/api/fetch-url', async (req, res) => {
  if (!await isUrlSafe(req.body.url)) {
    return res.status(403).json({ error: 'URL not allowed' });
  }
  const response = await axios.get(req.body.url, {
    timeout: 5000,
    maxRedirects: 0,
  });
  res.json(response.data);
});

const csrf = require('csurf');
const csrfProtection = csrf({ cookie: true });

app.get('/form', csrfProtection, (req, res) => {
  res.render('form', { csrfToken: req.csrfToken() });
});

app.post('/transfer', csrfProtection, (req, res) => {
  processTransfer(req.body);
});

// SameSite cookies for CSRF defense
res.cookie('session', sessionId, {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict',
  maxAge: 3600000,
});

const cors = require('cors');

// Vulnerable: allow all origins
app.use(cors()); // origin: '*'

// Secure: specific origins only
app.use(cors({
  origin: ['https://myapp.com', 'https://admin.myapp.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  credentials: true,
  maxAge: 86400,
}));

app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'nonce-abc123'"],
    styleSrc: ["'self'", "https://fonts.googleapis.com"],
    imgSrc: ["'self'", "data:", "https:"],
    connectSrc: ["'self'", "https://api.myapp.com"],
    fontSrc: ["'self'", "https://fonts.gstatic.com"],
    objectSrc: ["'none'"],
    frameSrc: ["'none'"],
  },
}));

const rateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');

const limiter = rateLimit({
  store: new RedisStore({
    sendCommand: (...args) => redisClient.call(...args),
  }),
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  keyGenerator: (req) => req.ip,
});

const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
const apiLimiter = rateLimit({ windowMs: 60 * 1000, max: 30 });

app.use('/api/auth', authLimiter);
app.use('/api/', apiLimiter);

app.use((req, res, next) => {
  // XSS defense
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-XSS-Protection', '0');

  // Clickjacking defense
  res.setHeader('X-Frame-Options', 'DENY');

  // Force HTTPS
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');

  // Referrer information restriction
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');

  // Browser feature restriction
  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');

  // CSP
  res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'");

  next();
});

# GitHub Actions security scan integration
name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Run Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten

      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'