OWASP Top 10 Web Security Guide: Vulnerabilities, Exploits, and Code Fixes

Web security is not an afterthought — it is a foundational requirement for any web application. A single unpatched vulnerability can lead to data breaches, massive financial loss, and severe reputational damage.

The OWASP Top 10 represents the most critical web application security risks recognized by security experts worldwide. In this guide, we examine the top threats and show exact code fixes.

1. Broken Access Control (#1 Security Risk)

Broken access control occurs when an application fails to properly enforce permissions, allowing users to access data or functions beyond their intended authorization.

Vulnerable Code Example (Express.js):

// BAD: No check if req.user owns document 42
app.get('/api/documents/:id', async (req, res) => {
  const doc = await db.query('SELECT * FROM docs WHERE id = ?', [req.params.id]);
  res.json(doc);
});

Secure Fix:

// GOOD: Enforce ownership check
app.get('/api/documents/:id', async (req, res) => {
  const doc = await db.query(
    'SELECT * FROM docs WHERE id = ? AND owner_id = ?', 
    [req.params.id, req.user.id]
  );
  if (!doc) return res.status(404).json({ error: 'Document not found or unauthorized' });
  res.json(doc);
});