OWASP security standards
The Open Web Application Security Project (OWASP) is an online community that mainly works on web application security problems by creating various studies and standards. In this chapter, we will follow the security standards of OWASP that were released in 2017 (https://www.owasp.org/index.php/Top_10-2017_Top_10):
Application security risks
The preceding diagram is a pictorial overview of an application's security risks. It depicts how an attacker might attack a weaker application. The attacker attacks application components by injecting scripts (mostly JavaScript) and impacting the system. In this image, you will notice that only an unsecured portion of the web application is under attack. A secure system is safe, even after it has been attacked.
The following are application security risks as defined by OWASP:
- Injection
- Broken authentication
- Sensitive data exposure
- XML external entities (XXE)
- Broken access control
- Security misconfiguration
- Cross-site scripting (XSS)
- Insecure...
