OWASP Security Cheat Sheet
OWASP Top 10 vulnerabilities, prevention strategies, and secure coding practices.
2 PagesIntermediateApr 20, 2026
OWASP Top 10 (2021)
The most critical web application security risks.
- A01- Broken Access Control
- A02- Cryptographic Failures
- A03- Injection (SQL, NoSQL, OS command)
- A04- Insecure Design
- A05- Security Misconfiguration
- A06- Vulnerable and Outdated Components
- A07- Identification and Authentication Failures
- A08- Software and Data Integrity Failures
- A09- Security Logging and Monitoring Failures
- A10- Server-Side Request Forgery (SSRF)
Preventing Injection
Use parameterized queries, never string concatenation.
sql
-- Vulnerable"SELECT * FROM users WHERE email = '" + email + "'"-- Safe: parameterized querySELECT * FROM users WHERE email = ?;
Security Headers
HTTP headers that reduce common attack surface.
text
Content-Security-Policy: default-src 'self'X-Content-Type-Options: nosniffX-Frame-Options: DENYStrict-Transport-Security: max-age=63072000
CSRF Protection
Defend state-changing requests with tokens and SameSite cookies.
javascript
// Express: double-submit cookie / SameSiteres.cookie("session", token, { httpOnly: true, secure: true, sameSite: "strict" // blocks cross-site cookie sending});// Verify a per-session CSRF token on unsafe methodsfunction verifyCsrf(req, res, next) { if (["POST","PUT","PATCH","DELETE"].includes(req.method)) { if (req.headers["x-csrf-token"] !== req.session.csrfToken) { return res.status(403).send("Invalid CSRF token"); } } next();}
Secure Password Storage
Hash credentials with a slow, salted algorithm.
javascript
import argon2 from "argon2";// Hash on signup (argon2id is the OWASP-recommended default)const hash = await argon2.hash(password, { type: argon2.argon2id, memoryCost: 19456, // 19 MiB timeCost: 2, parallelism: 1});// Verify on login — constant-time comparison built inconst ok = await argon2.verify(hash, password);// Never store plaintext, MD5, SHA-1, or unsalted SHA-256
Access Control Checklist
Guards against broken access control (OWASP A01).
- Deny by default- reject access unless a rule explicitly grants it
- Server-side checks- never trust client-supplied roles or hidden form fields
- Verify object ownership- confirm the record belongs to the user (stops IDOR/BOLA)
- Least privilege- grant the minimum scope needed, revoke unused permissions
- Rate limit & log- throttle sensitive actions and audit access failures
- Invalidate on logout- expire tokens/sessions server-side, not just client-side
Pro Tip
Validate and sanitize input at the boundary, but rely primarily on parameterized queries/ORMs and output encoding — never trust client-side validation alone.
Was this cheat sheet helpful?
Explore Topics
#OWASPSecurity#OWASPSecurityCheatSheet#Cybersecurity#Intermediate#OWASPTop102021#PreventingInjection#SecurityHeaders#CSRFProtection#Security#CheatSheet#SkillVeris
