Lesson 11 of 16 · Level 3: Advanced
Web Security and the OWASP Top 10 (Conceptual)
- ⏱ 14 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
In this lesson
- How a web application works, from the browser to the database, and where security can fail.
- The ten categories of the OWASP Top 10:2025, explained in plain English with defenses for each.
- What changed from the 2021 edition, including two brand-new categories.
- How to secure a site built on a platform like WordPress or a hosted store.
- The questions to ask a developer or vendor before you trust their web app with customer data.
Almost every business now runs something on the web: an online store, a client portal, a booking form, an API that connects two systems. The OWASP Top 10 is the best-known list of the most critical security risks to web applications, published by the Open Worldwide Application Security Project, a nonprofit foundation. This lesson explains each risk at a conceptual level, for owners, managers and future security professionals. The goal is to recognize the risks and know which defenses to ask for, not to test anyone's website. Probing systems you don't own or aren't authorized to test is illegal.
- See how web apps work
- Learn the Top 10
- Know what changed
- Secure your platform
- Ask the right questions
How a web application works
When a customer orders a mug from an online store, several pieces cooperate:
- The browser shows pages and sends the customer's requests.
- HTTPS (TLS encryption) protects the traffic between browser and server.
- The web server and application run the store's code, check who the user is and decide what they may do.
- A session (usually a cookie) remembers that the customer is logged in.
- The database stores accounts, orders and products.
- Third-party components (libraries, plugins, payment services, APIs) provide much of the functionality.
Each piece has to treat everything coming from users as untrusted, check permissions on every request and fail safely when something unexpected happens. Most of the Top 10 describes a way one of those duties breaks down.
The OWASP Top 10:2025, in plain English
| Rank | Category | What it means | Key defenses |
|---|---|---|---|
| A01 | Broken Access Control | Users can do or see things they shouldn't, like viewing another customer's order or reaching an admin function. In 2025 it also includes server-side request forgery (tricking a server into making requests on an attacker's behalf). | Deny by default; check authorization on the server for every request; test that users can only reach their own data |
| A02 | Security Misconfiguration | Insecure settings: default accounts, unnecessary features turned on, detailed error pages, overly open cloud storage. | Hardened, repeatable configurations; remove unused features; review settings after every change |
| A03 | Software Supply Chain Failures | Weaknesses in the components and processes you rely on: vulnerable libraries and plugins, compromised updates, insecure build systems. | Inventory components (an SBOM, or software bill of materials); update promptly; use trusted sources; protect the build pipeline |
| A04 | Cryptographic Failures | Sensitive data that isn't encrypted, or is encrypted badly: no HTTPS, outdated algorithms, weak password storage. | HTTPS everywhere; strong, current algorithms; store passwords with modern slow hashing; manage keys carefully |
| A05 | Injection | The app mixes user input into commands or database queries, so input can be interpreted as instructions. Includes cross-site scripting. | Parameterized queries; validate input; encode output; use frameworks that do this by default |
| A06 | Insecure Design | Flaws in the design itself, like a password reset that relies only on easily found answers. No amount of perfect code fixes a bad design. | Threat modeling before building; secure design patterns; abuse cases alongside use cases |
| A07 | Authentication Failures | Weak login and session handling: allowing breached passwords, no protection against automated guessing, sessions that never expire. | MFA or passkeys; block breached passwords; rate limiting; secure session management |
| A08 | Software or Data Integrity Failures | Trusting code or data without verifying it, such as unsigned updates or data that can be tampered with in transit. | Digital signatures; verify integrity of updates and critical data; review changes |
| A09 | Security Logging & Alerting Failures | Attacks happen and nobody notices because events aren't logged, or logs exist but no alert ever fires. | Log logins, failures and admin actions; send alerts to someone who acts; protect logs from tampering |
| A10 | Mishandling of Exceptional Conditions | The app handles errors and unusual situations unsafely: it crashes, leaks details in error messages or "fails open" and lets a request through when a check breaks. | Fail closed (deny when in doubt); handle errors consistently; show generic error messages to users |
1. A customer of an online store notices she can see other customers' names and addresses on the order history page. Which OWASP category does this fall under?
The app isn't enforcing who may see which records. The fix is server-side authorization checks on every request, so each user can only reach their own data.
Injection, explained without the hacking
Imagine a form that says "Enter your order number." If the application glues whatever you type directly into a database command, then unusual input could change the meaning of that command. The defense is to keep data and commands strictly separate. With parameterized queries, the application sends the command and the user's input to the database separately, so the input is always treated as plain data, never as instructions. Modern frameworks do this by default, which is one reason to use them rather than writing everything by hand.
2. Which practice is the primary defense against injection flaws in database queries?
Parameterized queries separate commands from data structurally. Input validation and output encoding help too, but you can't rely on users behaving, and "hidden" URLs aren't security.
What changed since 2021
| Category | 2021 | 2025 | Change |
|---|---|---|---|
| Broken Access Control | #1 | #1 | Server-side request forgery (a separate category in 2021) merged into it |
| Security Misconfiguration | #5 | #2 | Up three places |
| Software Supply Chain Failures | (Vulnerable and Outdated Components, #6) | #3 | New, broader category covering dependencies, build systems and distribution |
| Cryptographic Failures | #2 | #4 | Down two places |
| Injection | #3 | #5 | Down two places |
| Insecure Design | #4 | #6 | Down two places |
| Authentication Failures | #7 | #7 | Renamed (was "Identification and Authentication Failures") |
| Software or Data Integrity Failures | #8 | #8 | Same position |
| Security Logging & Alerting Failures | #9 | #9 | Renamed to stress alerting, not just monitoring |
| Mishandling of Exceptional Conditions | — | #10 | New: error handling, logic errors and failing open |
The theme is clear: more of today's risk sits in configuration and in the code you didn't write. That matches Verizon's 2026 DBIR, which found third parties involved in nearly half of breaches.
If your site runs on a platform
Most small businesses don't write their own web apps; they use WordPress, a hosted store builder or a booking service. The platform handles some security, but you still control a lot:
Admin access
MFA or passkeys on every admin account; separate accounts per person; no shared logins.
Covers: A01 and A07.Plugins and themes
Install only what you need, from reputable sources; update promptly; delete (not just deactivate) unused ones.
Covers: A03 and A02.Hosting protections
HTTPS, a web application firewall (WAF) if your host offers one, automatic backups and login alerts.
Covers: A04, A09 and recovery.Payments
Use the payment provider's hosted checkout or embedded fields so card data never touches your server.
Covers: reduces PCI DSS scope and the impact of a breach.Case: Rose City Ceramics cleans up its store
After scoring "admin account takeover" as a critical risk in lesson 10, the owner hired a developer for a one-day review. They removed plugins nobody used, updated the rest, cut admin accounts to the two people who truly needed them, turned on passkeys and moved checkout to the payment provider's hosted page.
42% fewer plugins (13 removed), zero outdated components and 71% fewer admin accounts: a smaller attack surface in one day.
3. A popular plugin used by thousands of stores is compromised and a malicious update is pushed to all of them. Which 2025 category best describes this risk?
The weakness is in a component and its distribution channel, not the store's own code. Defenses include a component inventory, trusted sources, staged updates, monitoring and fewer plugins overall.
If you build or commission web apps
Security is cheapest when it's designed in, not bolted on. A secure development process includes:
- DesignThreat modelingBefore coding, ask what could go wrong with each feature and who might abuse it (A06).
- BuildSecure defaults and code reviewUse frameworks that handle sessions, encoding and queries safely; review changes with a security checklist (A05, A07).
- DependenciesKnow and update your componentsKeep an SBOM, use automated dependency scanning and remove what you don't use (A03).
- TestAutomated and authorized testingStatic and dynamic analysis tools, plus professional penetration tests performed under a written agreement.
- RunMonitor, alert and accept reportsAlerts on suspicious activity (A09) and a vulnerability disclosure policy so researchers can report flaws responsibly.
Before you trust a vendor's web app with customer data, ask:
4. A payment-validation service times out, and the store's code is written to accept the order anyway "so customers aren't annoyed." Which risk does this illustrate, and what's the safer behavior?
"Failing open" turns an error into a security hole. Failing closed (deny or pause when a check can't complete) is the safe default, ideally with a friendly message and an alert to staff.
Common mistakes
"Our platform is secure, so our site is secure."
The platform secures its part; you still own admin accounts, plugins, settings and data.
Deactivating unused plugins but leaving them installed.
Delete them. Inactive code can still contain exploitable flaws.
Showing detailed error messages to visitors.
Show a generic message to users and log the details privately.
Running "free scans" against sites you don't own to "help."
Test only with written authorization. Report concerns through the owner's disclosure policy.
Practice exercise
A security firm hired by a Kansas City insurance agency delivers six findings about the agency's client portal: (1) a former employee's admin account still works; (2) the portal uses a JavaScript library with a known critical vulnerability; (3) error pages display database details; (4) no alert fires after 500 failed logins in an hour; (5) password reset relies on a date of birth only; (6) some pages load over HTTP instead of HTTPS. Map each to an OWASP Top 10:2025 category and choose the top three to fix first.
See solution
- 1. A01 Broken Access Control (also an identity process failure): disable it immediately.
- 2. A03 Software Supply Chain Failures: update the library and add dependency scanning.
- 3. A02 Security Misconfiguration (and A10 for unsafe error handling): show generic errors, log details privately.
- 4. A09 Security Logging & Alerting Failures: alert on repeated failures and add rate limiting (A07).
- 5. A06 Insecure Design (with A07): redesign reset to use a verified email or phone and MFA.
- 6. A04 Cryptographic Failures: enforce HTTPS everywhere and enable HSTS.
Top three: finding 1 (an active door for a known person, fix today), finding 2 (a known critical flaw that attackers scan for) and finding 5 (anyone who finds a client's birth date can take over the account). Then 6, 4 and 3.
Summary
- Web apps must distrust user input, check permissions on every request and fail safely.
- The OWASP Top 10:2025 runs from Broken Access Control (A01) to Mishandling of Exceptional Conditions (A10).
- 2025 added Software Supply Chain Failures and Mishandling of Exceptional Conditions, and Security Misconfiguration rose to #2.
- On platforms, you still own admin access, plugins, settings and how payments are handled.
- Design security in with threat modeling, safe frameworks, dependency management, authorized testing and alerting.
Next lesson: Identity and Access Management: Least Privilege. You'll learn to give every person exactly the access they need, manage accounts from hire to exit and run access reviews.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.