OWASP Top 10 2024: En Kritik Web Guvenligi Riskleri

OWASP Top 10 Nedir

OWASP web uygulamalarindaki en kritik 10 guvenlik aciklamasini yayinlar.

A01: Broken Access Control

// YANLIS
$id  = $_GET["id"];
$row = db()->query("SELECT * FROM users WHERE id = $id");

// DOGRU
$id = (int) $_GET["id"];
if ($id !== (int)$_SESSION["user_id"] && !is_admin()) {
    http_response_code(403); exit;
}

A02: Cryptographic Failures

// YANLIS
$hash = md5($sifre);

// DOGRU
$hash = password_hash($sifre, PASSWORD_ARGON2ID);

A03: SQL Injection

// YANLIS
$sql = "SELECT * FROM users WHERE email = " . $_POST["email"];

// DOGRU
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$_POST["email"]]);

A05: Security Misconfiguration

add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;

A07: Brute Force Engeli

function giris_dene(string $ip): bool {
    $key = "giris:" . $ip;
    $n   = (int) redis()->get($key);
    if ($n >= 5) return false;
    redis()->incr($key);
    redis()->expire($key, 900);
    return true;
}