🛡️ OWASP Top 10
Security is not a “feature” to be added at the end; it is a fundamental quality of the system. A Programmer assumes the environment is hostile and implements Defense in Depth, ensuring that the failure of one security control does not lead to a total compromise.
🏗️ The Critical Risks (Selection)
Section titled “🏗️ The Critical Risks (Selection)”1. Broken Access Control
Section titled “1. Broken Access Control”This is currently the #1 risk. It occurs when users can access resources outside of their intended permissions.
- IDOR (Insecure Direct Object Reference): Changing a URL from
/api/orders/100to/api/orders/101to see someone else’s data. - Programmer Mitigation: Implement a centralized authorization layer. Never trust the client-side ID; always verify ownership on the server side using the session/token identity.
2. Cryptographic Failures
Section titled “2. Cryptographic Failures”Exposure of sensitive data (PII, passwords, credit cards) due to weak encryption or lack thereof.
- Common Mistake: Using outdated algorithms like MD5 or SHA1 for passwords.
- Programmer Mitigation: Use Argon2 or bcrypt for password hashing. Ensure all data in transit is encrypted via TLS 1.3 and sensitive data at rest is encrypted with AES-256.
3. Injection (SQL, NoSQL, OS)
Section titled “3. Injection (SQL, NoSQL, OS)”Occurs when untrusted data is sent to an interpreter as part of a command or query.
- Example:
SELECT * FROM users WHERE name = '+userInput+'. - Programmer Mitigation: Always use parameterized queries (Prepared Statements) or ORMs that handle this by default. Never concatenate strings to build queries.
🧪 Injection & Cross-Site Scripting (XSS)
Section titled “🧪 Injection & Cross-Site Scripting (XSS)”XSS (Cross-Site Scripting)
Section titled “XSS (Cross-Site Scripting)”An attacker injects malicious scripts into content sent to other users.
- Stored XSS: The script is saved in the DB (e.g., a comment) and executed for every user who views it.
- Reflected XSS: The script is part of a URL parameter.
- Programmer Mitigation:
- Escape by Default: Use frameworks like React or Vue that auto-escape content.
- Content Security Policy (CSP): A browser-level instruction that restricts where scripts can be loaded from.
CSRF (Cross-Site Request Forgery)
Section titled “CSRF (Cross-Site Request Forgery)”Forces an authenticated user to execute unwanted actions on a web application.
- Programmer Mitigation: Use
SameSite=LockerorSameSite=Strictcookies and anti-CSRF tokens for state-changing requests (POST, PUT, DELETE).
🔒 API Hardening Patterns
Section titled “🔒 API Hardening Patterns”Rate Limiting & Throttling
Section titled “Rate Limiting & Throttling”Protects against Brute Force and DoS (Denial of Service) attacks.
- Implementation: Use a sliding window algorithm (often via Redis) to limit requests per IP or per API Key.
Input Sanitization vs. Validation
Section titled “Input Sanitization vs. Validation”- Validation: Ensuring the data follows the correct format (e.g., “Is this a valid email?”).
- Sanitization: Cleaning the data to remove dangerous characters (e.g., removing
<script>tags). - Programmer Rule: Validate at the entry point, sanitize before use.
⚖️ The “Security Culture”
Section titled “⚖️ The “Security Culture””The Principle of Least Privilege
Section titled “The Principle of Least Privilege”An application component (e.g., a microservice) should only have the access it needs to perform its job. If the service only reads data, its DB user should not have DROP TABLE permissions.
Secrets Management
Section titled “Secrets Management”- Never commit secrets to Git. Use Secret Scanning in your CI/CD.
- Dynamic Secrets: Use tools like HashiCorp Vault to generate short-lived credentials that expire automatically.
💡 Note: Security is a trade-off with Usability. A system that requires a 20-character password changed every week will lead to users writing passwords on sticky notes. Your goal is to make the secure path the easiest path for both developers and users.