OWASP Top 10

What is OWASP?

OWASP (Open Web Application Security Project) is a nonprofit foundation that works to improve software security. The OWASP Top 10 is a standard awareness document for web application security risks.

OWASP Top 10 (2021)

1. Broken Access Control

Risk: Users can access unauthorized resources.

Example: User changes URL to access admin panel.

Prevention: Use [Authorize] attributes, implement proper authorization policies.

2. Cryptographic Failures

Risk: Sensitive data exposed due to weak encryption.

Example: Passwords stored in plain text.

Prevention: Use ASP.NET Core Data Protection API, hash passwords with Identity.

3. Injection

Risk: Malicious code injected into queries (SQL, NoSQL, OS commands).

Example: SQL Injection: SELECT * FROM Users WHERE Id = '1 OR 1=1'

Prevention: Use parameterized queries, Entity Framework Core, input validation.

4. Insecure Design

Risk: Missing or ineffective security controls in design.

Example: No rate limiting on login attempts.

Prevention: Threat modeling, secure design patterns, defense in depth.

5. Security Misconfiguration

Risk: Insecure default configurations, incomplete setups.

Example: Detailed error messages in production.

Prevention: Disable detailed errors in production, remove unused features, keep dependencies updated.

if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}
else
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

6. Vulnerable and Outdated Components

Risk: Using libraries with known vulnerabilities.

Example: Old NuGet packages with security flaws.

Prevention: Regularly update NuGet packages, use dotnet list package --vulnerable.

7. Identification and Authentication Failures

Risk: Weak authentication mechanisms.

Example: No password complexity requirements, no MFA.

Prevention: Use ASP.NET Core Identity, implement MFA, enforce strong passwords.

8. Software and Data Integrity Failures

Risk: Code/data modified without integrity verification.

Example: Insecure CI/CD pipeline, unsigned packages.

Prevention: Use signed packages, verify integrity, secure CI/CD.

9. Security Logging and Monitoring Failures

Risk: Attacks go undetected due to insufficient logging.

Example: No logging of failed login attempts.

Prevention: Use ILogger, log security events, set up alerts.

_logger.LogWarning("Failed login attempt for user {Email}", email);

10. Server-Side Request Forgery (SSRF)

Risk: Application fetches remote resources without validation.

Example: User provides URL that accesses internal network.

Prevention: Validate and sanitize URLs, use allowlists, disable unnecessary protocols.

ASP.NET Core Built-in Protections

• Anti-forgery tokens: Automatic CSRF protection
• Razor encoding: Automatic XSS protection
• Data Protection API: Secure data encryption
• HTTPS enforcement: UseHttpsRedirection()
• CORS: Cross-origin resource sharing control
• Rate limiting: Built-in middleware

Key Takeaways

• OWASP Top 10: Most critical web security risks
• Broken Access Control: #1 risk - use authorization
• Injection: Use parameterized queries
• Security Misconfiguration: Disable detailed errors in production
• Logging: Monitor security events
• ASP.NET Core: Many built-in protections