Overview
Application security is mostly a small set of recurring vulnerability classes exploited for decades because the same mistakes keep being rewritten. The OWASP Top 10 is the shared vocabulary; the deeper lesson is that nearly all of them reduce to one root cause — trusting input — and nearly all defenses reduce to a few habits: parameterize, encode for context, deny by default, and keep components patched.
Key points
- Injection: user input spliced into an interpreter — SQL, OS commands, LDAP, templates. Defense is structural, not sanitization: parameterized queries/prepared statements, never string-built commands.
- XSS: attacker-controlled content executing in a victim's browser. Contextual output encoding (what template engines do when you don't bypass them), Content-Security-Policy as the safety net; stored vs. reflected vs. DOM-based.
- CSRF: a victim's browser making authenticated requests the victim didn't intend — possible because cookies ride along automatically. SameSite cookies (now default-ish), anti-CSRF tokens, and "state-changing = never GET".
- Broken access control (OWASP #1): IDOR (guessing other users' object IDs), missing function-level checks, path traversal. Authorization enforced server-side on every request, deny by default — see authentication & authorization.
- SSRF: the server fetching attacker-chosen URLs — the cloud-era killer (169.254.169.254 metadata endpoints); allowlist outbound destinations, block link-local ranges.
- Insecure deserialization & supply chain: deserializing untrusted data as code (Java's gadget chains), and vulnerable/compromised dependencies (Log4Shell) — SCA scanning, lockfiles, minimal dependencies.
- The habits: validate input at trust boundaries (allowlist), encode output for its context, secure defaults, least privilege, defense in depth, and security headers (CSP, HSTS, X-Content-Type-Options) as cheap wins.
- Shift-left tooling: SAST/DAST/SCA in CI, dependency update bots, secret scanning — security as pipeline stages, not an annual audit.
- To explore: the OWASP ASVS as a checklist beyond the Top 10, race-condition (TOCTOU) bugs, DNS rebinding, browser security model (same-origin policy, CORS — widely misunderstood as a server protection; it protects users).
Practice
- OverTheWire Natas (source) — server-side web-security wargame, level by level; the gentle on-ramp to how these bugs actually feel.
- PortSwigger Web Security Academy (source) — free labs grouped by vuln class (SQLi, XSS, CSRF, SSRF, access control), apprentice to expert — the definitive drill ground.
- OWASP WebGoat (source) — guided, explained lessons that pair each exploit with the fix.
- OWASP Juice Shop (source) — a full deliberately-vulnerable app run as a CTF; hunt the whole Top 10 in one realistic codebase.
Related
- Threat modeling — finding which of these applies to your design before writing it.
- Authentication & authorization — the identity-side failure modes.
- Hardening Linux — the host layer beneath the app.
- API design — where the trust boundaries are declared.