OWASP Top 10 2025: What Every Developer Must Know

The OWASP Top 10 is the definitive list of the most critical web application security risks. Every developer should understand it — not just security teams.

The 2025 OWASP Top 10

A01: Broken Access Control

Users accessing data/functions they shouldn't have permission to.

// ❌ Vulnerable: trusts client-side role
app.get('/admin/users', (req, res) => {
  if (req.body.isAdmin) return res.json(allUsers); // Attacker sets isAdmin: true
});
 
// ✅ Fixed: server-side role verification
app.get('/admin/users', authenticate, requireRole('admin'), async (req, res) => {
  return res.json(await User.findAll());
});

A02: Cryptographic Failures

Sensitive data exposed due to weak/missing encryption.

• HTTP instead of HTTPS
• Weak hashing for passwords (MD5, SHA1)
• Sensitive data in URLs or logs

// ❌ MD5 is broken for passwords
const hash = crypto.createHash('md5').update(password).digest('hex');
 
// ✅ Use bcrypt or argon2
import bcrypt from 'bcrypt';
const hash = await bcrypt.hash(password, 12);

A03: Injection

SQL, NoSQL, command, LDAP injection — untrusted data sent as commands.

Already covered in depth this month. Use parameterized queries.

A04: Insecure Design

Security not considered in the design phase. No threat modeling. Race conditions by design.

A05: Security Misconfiguration

Default credentials. Unnecessary features enabled. Error messages revealing stack traces. Missing security headers.

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000

A06: Vulnerable and Outdated Components

Using dependencies with known CVEs.

npm audit           # Check for vulnerable packages
snyk test           # More comprehensive scanning
dependabot          # Automated PR updates

A07: Identification and Authentication Failures

Weak passwords allowed. No MFA. Session IDs not rotated after login.

A08: Software and Data Integrity Failures

CI/CD pipeline compromised. Unverified updates. Insecure deserialization.

A09: Security Logging and Monitoring Failures

No logs. No alerts. Average breach detection: 200+ days without proper monitoring.

A10: Server-Side Request Forgery (SSRF)

Attacker tricks server into making requests to internal systems.

// ❌ Vulnerable: fetches any URL the user provides
const data = await fetch(req.body.url);
 
// ✅ Validate and allowlist URLs
const allowedDomains = ['api.trusted.com'];
const url = new URL(req.body.url);
if (!allowedDomains.includes(url.hostname)) throw new Error('Forbidden');

Know these. Build with them in mind from day one.