Web Application Security Risks: A Look at OWASP Top Ten 2017
summary
Release candidate of OWASP Top Ten 2017 is available and the list shifts names and priorities: SQL injection remains high but is rarer in modern ORMs, authentication/session management and XSS stay critical, and Content Security Policy is presented as a practical defense (demo shows inline scripts blocked and allowed via SHA hashes). Concrete failures include mass‑assignment/model binding leading to unauthorized fields, missing HSTS preload for HTTPS, and a window.opener redirect attack fixed by rel="noopener"; migration to CSP in legacy apps repeatedly succeeds.
AI-written summary · about
chapters (13)
- 0:00Introduction to OWASP
- 1:32Injection vulnerabilities
- 6:18Broken authentication
- 9:31Cross-site scripting (XSS)
- 15:27Same origin policy
- 21:32Content security policy
- 26:46Broken access control
- 35:13Security misconfiguration
- 41:56Sensitive data exposure
- 46:11Insufficient protection
- 48:37Cross-site request forgery
- 52:54Known vulnerabilities
- 53:33Underprotected APIs
related talks
53mOWASP Top 10: What are them and how to prevent them
47mOWASP Top 10
30mTop 10 Introduction
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
01h 02mUnderstanding the OWASP Top 10
43mFrom OWASP top 10 to Secure Applications
29mFlagship Projects: Top 10 "Intro of Top 10"
58m: The OWASP Top Ten Proactive Controls 2018