This lesson's interactive features are locked, please to keep using them

OWASP Top 10

OWASP (the Open Worldwide Application Security Project) publishes a new list of critical web application security risks every few years. The OWASP Top 10:2025 combines contributed application-testing data with a survey of security practitioners. It's based on real-world data!

The Top 10 is a great starting point, but it's not a complete security checklist.

Click to play video

Here are the current categories:

A01: Broken Access Control – Users can do things they shouldn't be allowed to do.
A02: Security Misconfiguration – The system is deployed or configured in an unsafe way.
A03: Software Supply Chain Failures – Vulnerabilities enter through outdated or compromised third-party libraries or build tools.
A04: Cryptographic Failures – Sensitive data is exposed because cryptographic protections are missing or misused.
A05: Injection – Untrusted input is treated as executable instructions.
A06: Insecure Design – The system's design lacks the controls needed to resist attacks.
A07: Authentication Failures – The system doesn't reliably verify who a user is.
A08: Software or Data Integrity Failures – The application trusts software or data without verifying its integrity.
A09: Security Logging and Alerting Failures – Attacks happen without triggering the records or alerts needed for a response.
A10: Mishandling of Exceptional Conditions – Unexpected conditions expose details, bypass controls, or leave the system in a bad state.

You do not need to memorize this list. You do need to know where to find it and how to use it as a guide for identifying potential issues in your application.

NoSniff

Missing browser security headers are a concrete example of A02: Security Misconfiguration. One of the simplest headers to add is X-Content-Type-Options: nosniff.

This header tells browsers to respect a response's declared Content-Type instead of guessing from its contents.

This helps prevent security vulnerabilities related to MIME sniffing. For example, without nosniff, a browser might treat attacker-controlled content as executable code despite its declared type!

Assignment

Bearly Secure does not currently send the X-Content-Type-Options header. Set X-Content-Type-Options: nosniff on every Bearly Secure response.

In src/app.ts, find the existing middleware registered with app.use near the beginning of createApp. Before it calls next, use res.set to set the header.
Restart the app in development mode:
```
npm run dev
```

Use curl to check the header:

curl -I http://localhost:3000/
curl -I http://localhost:3000/styles.css

Leave the app running, then run and submit the CLI checks from another terminal.