OWASP Top Ten

The OWASP Top Ten is a standard awareness document representing the most critical security risks to web applications. It's published by the Open Worldwide Application Security Project (OWASP), a non-profit foundation dedicated to improving software security.

SQL Injection Prevention (Node.js)

// Never do this!
const query = "SELECT * FROM users WHERE id = " + userId;
db.query(query, (err, result) => {
  // Process result
});

// Use parameterized queries
const query = "SELECT * FROM users WHERE id = ?";
db.query(query, [userId], (err, result) => {
  // Process result
});

Access Control Implementation

// Middleware for role-based access control
function authorize(roles = []) {
  return (req, res, next) => {
    if (!req.user) {
      return res.status(401).json({ message: 'Unauthorized' });
    }
    
    if (roles.length && !roles.includes(req.user.role)) {
      return res.status(403).json({ message: 'Forbidden' });
    }
    
    next();
  };
}

// Usage
app.get('/api/admin', authorize(['admin']), (req, res) => {
  res.json({ message: 'Admin access granted' });
});