OWASP Top 10

The OWASP Top 10 is an awareness document from the Open Worldwide Application Security Project (OWASP) that ranks the most critical categories of web application security risk, based on data and community input. It is updated every few years.

Why it matters

The list gives developers, testers and managers a common starting vocabulary and a baseline for secure development and audits. Categories have included broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable and outdated components, authentication failures, integrity failures, logging and monitoring failures, and server-side request forgery. Exact names and order change between editions.

Example

A team uses the current edition as a checklist during code review. For broken access control they test that every endpoint checks ownership on the server. For injection they confirm that queries are parameterised. Findings are tracked as tickets with the matching category.

Common misconceptions

• "Passing the Top 10 means the app is secure." It is a minimum awareness list, not a full standard. OWASP's ASVS covers verification in more depth.
• "It is a ranking of attacks." It groups risk categories, not single techniques.
• "It only applies to websites." Related lists exist for APIs and mobile apps.

Related

• SQL injection
• XSS
• SSRF
• Security audit

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.