OWASP Top 10 2024 Security Checklist

A developer-focused checklist covering the most critical web application security risks. Use this during code review, security audits, and pre-launch hardening.

The OWASP Top 10 — Quick Reference Table

A03 — Injection Prevention

Injection attacks occur when untrusted data is sent to an interpreter as part of a command or query. SQL injection remains the most exploited vulnerability across all languages and frameworks.

Vulnerable SQL (Never do this)

// ❌ VULNERABLE — direct string interpolation
const query = `SELECT * FROM users WHERE email = '{req.body.email}'`;
// Attacker input: ' OR '1'='1
// Resulting query: SELECT * FROM users WHERE email = '' OR '1'='1'
// Returns ALL users!

Safe Parameterized Query (Node.js / pg)

// ✅ SAFE — parameterized query
const result = await pool.query(
  'SELECT * FROM users WHERE email = $1',
  [req.body.email]  // value is never interpolated into SQL
);

// ✅ SAFE — with an ORM (Prisma)
const user = await prisma.user.findFirst({
  where: { email: req.body.email }
});

Python SQLAlchemy (Safe)

from sqlalchemy import text

# ✅ SAFE — bound parameters
result = db.execute(
    text("SELECT * FROM users WHERE email = :email"),
    {"email": email_input}
)

# ❌ VULNERABLE — f-string in query
result = db.execute(f"SELECT * FROM users WHERE email = '{email_input}'")

A03 — XSS Prevention

Cross-Site Scripting (XSS) lets attackers inject client-side scripts into pages viewed by other users. Reflected XSS comes from request data; stored XSS persists in the database; DOM-based XSS manipulates client-side code.

Content Security Policy Header

# Nginx — strong CSP header
add_header Content-Security-Policy
  "default-src 'self';
   script-src 'self' 'nonce-{NONCE}';
   style-src 'self' 'unsafe-inline';
   img-src 'self' data: https:;
   font-src 'self';
   connect-src 'self' https://api.yourapp.com;
   frame-ancestors 'none';"
  always;

Sanitize HTML before rendering (DOMPurify)

import DOMPurify from 'dompurify';

// ❌ XSS risk — never do this with user content
element.innerHTML = userContent;

// ✅ SAFE — sanitize first
const clean = DOMPurify.sanitize(userContent, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
  ALLOWED_ATTR: ['href']
});
element.innerHTML = clean;

A05 — Security Misconfiguration: CORS

CORS misconfiguration is one of the most common real-world vulnerabilities. A wildcard Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true is a critical vulnerability that allows any origin to make credentialed requests.

Misconfigured CORS (Dangerous)

// ❌ DANGEROUS — wildcard with credentials
app.use(cors({
  origin: '*',
  credentials: true  // This combination is a critical vuln!
}));

// ❌ DANGEROUS — reflecting Origin header without validation
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', req.headers.origin);
  res.header('Access-Control-Allow-Credentials', 'true');
  next();
});

Correct CORS Configuration (Express)

// ✅ SAFE — explicit allowlist
const ALLOWED_ORIGINS = [
  'https://app.yourcompany.com',
  'https://admin.yourcompany.com',
];

app.use(cors({
  origin: (origin, callback) => {
    if (!origin || ALLOWED_ORIGINS.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
}));

A01 — Broken Access Control (IDOR)

Access control enforces that users can only act within their intended permissions. IDOR (Insecure Direct Object Reference) is the most common access control failure found in bug bounty programs.

// ❌ VULNERABLE — no authorization check
app.get('/api/invoices/:id', async (req, res) => {
  const invoice = await db.invoices.findById(req.params.id);
  res.json(invoice);  // Any authenticated user can read any invoice!
});

// ✅ SAFE — verify ownership
app.get('/api/invoices/:id', authenticate, async (req, res) => {
  const invoice = await db.invoices.findOne({
    id: req.params.id,
    userId: req.user.id  // Must belong to requesting user
  });
  if (!invoice) return res.status(404).json({ error: 'Not found' });
  res.json(invoice);
});

Security Headers Checklist