OWASP Top 10: Complete Guide

Failures to properly enforce what authenticated users can do. Users can act outside their intended permissions, accessing other users' data or admin functionality.

Common Vulnerabilities:

• IDOR: /api/users/123 → Change to /api/users/456 to access others
• Forced browsing: Access /admin without admin role
• Privilege escalation: Modify role in JWT/cookie
• CORS misconfiguration: Allowing arbitrary origins

// IDOR - Insecure Direct Object Reference
GET /api/orders/12345  // Attacker changes to 12346

// Fix: Verify ownership
app.get('/api/orders/:id', (req, res) => {
  const order = getOrder(req.params.id);
  if (order.userId !== req.user.id) {
    return res.status(403).json({error: 'Forbidden'});
  }
  res.json(order);
});

Failures related to cryptography that lead to exposure of sensitive data. Previously called "Sensitive Data Exposure."

• Transmitting data in cleartext (HTTP, FTP, SMTP)
• Using deprecated algorithms (MD5, SHA1, DES)
• Weak or hard-coded encryption keys
• Not enforcing encryption (missing TLS)
• Storing passwords with unsalted/weak hashes

// BAD: MD5 for passwords
$hash = md5($password);

// GOOD: bcrypt with proper cost
$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);

// GOOD: Argon2id (preferred)
$hash = password_hash($password, PASSWORD_ARGON2ID);

User-supplied data is sent to an interpreter as part of a command or query. Includes SQL, NoSQL, OS command, LDAP, and XSS injection.

// SQL Injection
$query = "SELECT * FROM users WHERE id = " . $_GET['id'];
// Attack: ?id=1 OR 1=1

// Prevention: Parameterized queries
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$_GET['id']]);

// Command Injection
system("ping " . $_GET['host']);
// Attack: ?host=127.0.0.1; rm -rf /

// Prevention: Whitelist validation
if (!filter_var($_GET['host'], FILTER_VALIDATE_IP)) die("Invalid");

Weaknesses in authentication mechanisms: session management, credential stuffing, brute force, weak passwords.

• Permits brute force attacks
• Allows weak passwords ("password123")
• Session IDs in URLs
• Doesn't invalidate sessions on logout
• Missing MFA on sensitive operations

New in 2021. Application fetches a remote resource without validating user-supplied URL, allowing attackers to access internal services.

// Vulnerable code
$url = $_GET['url'];
$content = file_get_contents($url);

// Attack: ?url=http://169.254.169.254/latest/meta-data/ (AWS)
// Attack: ?url=http://localhost:6379/ (internal Redis)
// Attack: ?url=file:///etc/passwd

// Prevention: Allowlist URLs
$allowed = ['api.example.com', 'cdn.example.com'];
$host = parse_url($url, PHP_URL_HOST);
if (!in_array($host, $allowed)) die("Blocked");