Top 10 OWASP Security Concerns
Check the official OWASP Top 10.
1. Broken Access Control
Users cannot act outside their intended permissions. Failures can lead to unauthorized information disclosure, modification or destruction of data, or users performing tasks they shouldn't be able to perform.
2. Cryptographic Failures
If you're working with sensitive data, ensure all cryptographic measures work as intended. Keep track of everywhere you handle sensitive data in every project you maintain so you know what to update when necessary. See the detailed steps.
3. Injection
The most common form is non-validated user input, but it can happen anywhere data is processed, even within internal calls where user input is not expected but can arrive. Read more about injection.
4. Insecure Design
Even with perfect implementation, an insecurely designed application remains insecure. Secure software requires a secure development lifecycle, paved-road methodology, tooling and threat modeling. Reach out to security specialists if you have doubts about your design.
5. Security Misconfiguration
The more configurable software you use, the more likely it is that one part will not be configured securely and may compromise your security. Pay attention to configuration permissions for everything you add. Read more about security misconfiguration.
6. Vulnerable and Outdated Components
Vet every component you use and automate processes so that when an update happens or a vulnerability is discovered, you are notified and can act. Read the official documentation.
7. Identification and Authentication Failures
Ensure only secure passwords are accepted, protect against brute force and automated attacks, use proper password recovery mechanisms, validate session IDs, generate new IDs on login and don't expose session IDs in URLs. Read more about authentication failures.
8. Software and Data Integrity Failures
Imported data and software or libraries can have vulnerabilities and should be confirmed as secure. Read the official documentation.
9. Security Logging and Monitoring Failures
You need proper logging and monitoring to know if a security breach is being exploited or an attack is taking place. See the official guidelines.
10. Server-Side Request Forgery (SSRF)
SSRF flaws occur when a web application fetches a remote resource without validating the user-supplied URL. This can allow an attacker to make the application send a crafted request to an unexpected destination, even when protected by a firewall, VPN or access-control list. Read more about SSRF.