What is OWASP Top 10?
The OWASP Top 10 is a widely used list of the most critical security risks to web applications.
It is published by the Open Worldwide Application Security Project and updated every few years from real-world data. Categories include broken access control, cryptographic failures, injection, insecure design and security misconfiguration.
It is commonly used as a baseline for security testing and secure coding, and is referenced in many compliance requirements.
Example
Broken access control is the top category in the 2021 list. A typical example is an API that lets a user change an ID in the URL and read another user’s data.
Best practices
- Use it as a minimum testing checklist
- Automate checks for injection, XSS and access control
- Review misconfigurations such as headers and CORS
- Track findings to closure
Ship without fear.
Start testing free in minutes, or let a QAShift engineer deliver your first morning report within 5 days.