This lesson's interactive features are locked, please to keep using them

OWASP Top 10

OWASP (the Open Worldwide Application Security Project) publishes a new list of critical web application security risks every few years. The OWASP Top 10:2025 combines contributed application-testing data with a survey of security practitioners. It's based on real-world data!

The Top 10 is a great starting point, but it's not a complete security checklist.

Click to play video

Here are the current categories:

A01: Broken Access Control – Users can do things they shouldn't be allowed to do.
A02: Security Misconfiguration – The system is deployed or configured in an unsafe way.
A03: Software Supply Chain Failures – Vulnerabilities enter through outdated or compromised third-party libraries or build tools.
A04: Cryptographic Failures – Sensitive data is exposed because cryptographic protections are missing or misused.
A05: Injection – Untrusted input is treated as executable instructions.
A06: Insecure Design – The system's design lacks the controls needed to resist attacks.
A07: Authentication Failures – The system doesn't reliably verify who a user is.
A08: Software or Data Integrity Failures – The application trusts software or data without verifying its integrity.
A09: Security Logging and Alerting Failures – Attacks happen without triggering the records or alerts needed for a response.
A10: Mishandling of Exceptional Conditions – Unexpected conditions expose details, bypass controls, or leave the system in a bad state.

You do not need to memorize this list. You do need to know where to find it and how to use it as a guide for identifying potential issues in your application.

NoSniff

Missing browser security headers are a concrete example of A02: Security Misconfiguration. One of the simplest headers to add is X-Content-Type-Options: nosniff.

This header tells browsers to respect a response's declared Content-Type instead of guessing from its contents.

This helps prevent security vulnerabilities related to MIME sniffing. For example, without nosniff, a browser might treat attacker-controlled content as executable code despite its declared type!

Bearly Secure composes global middleware around its main http.Handler. Middleware can set the header before passing the request to the next handler, which applies the policy to both application routes and static files.

Assignment

Bearly Secure does not currently send the X-Content-Type-Options header. Set X-Content-Type-Options: nosniff on every Bearly Secure response.

In internal/httpserver/middleware.go, add middleware that sets X-Content-Type-Options: nosniff before passing the request to the next handler.
Register the middleware in the global chain in internal/httpserver/app.go so it applies to application and static-file responses.
Restart Bearly Secure:
```
go run ./cmd/server
```

Use curl to check the header:

curl -I http://localhost:3030/
curl -I http://localhost:3030/styles.css

With Bearly Secure still running, run and submit the CLI tests from a separate terminal in the project root.