Web Security Guide for Developers: OWASP Top 10 Basics

1. Think like an attacker

1. 1. Security for Developers · 12 min
   The Security Mindset: Threats, Attack Surface and the OWASP Top 10

   How attackers think, what to protect, threat modelling in four questions, defence in depth, least privilege, and a map of the OWASP Top 10 so you know where each lesson fits.

2. The classic bugs

Injection and browser attacks cause a large share of real breaches.

1. 2. Security for Developers · 14 min
   Injection: SQL Injection, Command Injection and How to Stop Them

   A real SQL injection on a tiny login, then the fix with parameterised queries. Also command injection, NoSQL injection and the rule behind all of them: never mix data into code.

2. 3. Security for Developers · 16 min
   XSS, CSRF, Clickjacking and Security Headers

   How a script gets into your page and how to stop it with output encoding and CSP, how CSRF uses your cookies, SameSite and CSRF tokens, frame-ancestors, and the headers worth setting.

3. 4. The Browser Contract · 18 min
   Where Do Tokens Live? XSS, CSRF and the Storage Trade-off

   localStorage lets XSS steal tokens. Cookies let CSRF attacks use you. Safe patterns: HttpOnly cookies with SameSite or CSRF tokens, access tokens kept in memory, and a backend-for-frontend.

3. Login, access and secrets

1. 5. Security for Developers · 16 min
   Passwords and Login: Hashing, Sessions, MFA and Rate Limits

   Why you never store passwords, hashing with a salt (scrypt and Argon2), safe sessions and JWT mistakes, password reset flows, MFA, and stopping brute force.

2. 6. Security for Developers · 14 min
   Access Control: IDOR, Roles and Mass Assignment

   The number one web risk: checking who you are but not what you may do. IDOR with a real example, deny by default, roles and ownership checks, and mass assignment.

3. 7. Security for Developers · 15 min
   Secrets, Encryption and Data Protection

   Where secrets leak (git, logs, front-end bundles), hashing vs encryption vs encoding, TLS in plain words, safe randomness, encrypting data with AES-GCM, and handling personal data.

4. 8. The Browser Contract · 20 min
   Sessions vs JWT: Stateful vs Stateless Login

   What a signed JWT is, how it is different from a plain session ID, and where “stateless” stops helping: logging out, expiry, refresh tokens and the claims you must check.

4. Dependencies, APIs and servers

1. 9. Security for Developers · 13 min
   Dependencies and the Supply Chain: npm, Lockfiles and GitHub Actions

   How a package you did not write can hurt you: typosquatting, install scripts, malicious updates. Lockfiles, npm audit, Dependabot, secret scanning and securing your CI.

2. 10. Security for Developers · 15 min
   APIs and Servers: SSRF, File Uploads, Rate Limits and Misconfiguration

   Server-side request forgery, unsafe file uploads, missing rate limits, verbose errors, CORS mistakes and the OWASP API Top 10, each with a small example and a fix.

3. 11. The Browser Contract · 15 min
   CORS Explained: Same-Origin Policy, Preflights and Credentials

   Why CORS protects the browser and is not a firewall for the server, what makes a preflight request, and why you cannot use a wildcard origin together with credentials.

5. Put it into practice

1. 12. Security for Developers · 16 min
   Security in Practice: Code Review Checklist, Testing, Incidents and Interview Answers

   A review checklist you can use tomorrow, SAST, DAST and dependency scans, what to do in the first hour of an incident, and the security questions interviewers ask with model answers.

2. 13. Full-Stack Questions · 32 min
   Security in Depth for Full-Stack Developers

   SSRF, path traversal, prototype pollution, ReDoS, unsafe deserialization, injection, password hashing, headers, rate limits, secrets, supply chain, uploads and a threat-model routine.