OWASP Top 10 in Practice

Read before you buy: the PDF here is a free sample — the first 20 pages of the 454-page book (payments, sales and reviews on this demo site are sample data). Get the full e-book at thenexbooks on Gumroad.

Most vulnerabilities are not exotic. They are ordinary code: a query built with string concatenation, an endpoint that checks you are logged in but not whether the record is yours, a reset token that never expires.

This book teaches developers to recognize those patterns, understand why the standard defenses work, and fix them — organized around the OWASP Top 10 and going further into authentication, OAuth 2.0, API security, the software supply chain, security testing, and AI-powered features. Every risk is shown in realistic code, first vulnerable and then fixed, using one running example: the Lattice Learn online learning platform.

WHAT'S INSIDE
➔ 454 pages · 28 chapters in 6 parts + 4 appendices
➔ All ten OWASP Top 10 (2021) categories in depth, with vulnerable vs. fixed code
➔ Examples in TypeScript (Express), Python (FastAPI), and Java (Spring Boot)
➔ Access control for multi-tenant apps, passwords and MFA, sessions, JWT pitfalls, OAuth 2.0 and OpenID Connect
➔ SQL/NoSQL injection, XSS and Content Security Policy, CSRF, file uploads, deserialization, XXE, SSRF
➔ Cryptography, secrets management, secure design, and the OWASP API Security Top 10 (2023)
➔ Misconfiguration, dependency and supply-chain security, CI/CD integrity, logging and detection, SAST/DAST, DevSecOps
➔ Securing AI features: prompt injection, data leakage, and excessive agency
➔ A full security review case study and an API hardened step by step
➔ OWASP Top 10 cheat sheet, secure code templates, and a pre-release checklist

Table Of Contents

PART I — SECURITY FOUNDATIONS

• Ch 1 · Why Application Security Is a Developer's Job
• Ch 2 · How Web Applications Are Attacked: HTTP, Browsers, and Trust Boundaries
• Ch 3 · Threat Modeling for Developers
• Ch 4 · Using the OWASP Top 10, ASVS, CWE, and the API Security Top 10

PART II — ACCESS CONTROL AND IDENTITY

• Ch 5 · A01 Broken Access Control, Part 1: IDOR and Missing Function-Level Authorization
• Ch 6 · A01 Broken Access Control, Part 2: Multi-Tenancy, Path Traversal, and CORS
• Ch 7 · A07 Authentication Failures: Passwords, MFA, and Account Recovery
• Ch 8 · Sessions, Cookies, and Tokens: Secure Sessions and JWT Pitfalls
• Ch 9 · OAuth 2.0 and OpenID Connect Done Right

PART III — INJECTION AND UNTRUSTED INPUT

• Ch 10 · A03 Injection, Part 1: SQL and NoSQL Injection
• Ch 11 · A03 Injection, Part 2: OS Command, Template, and Header Injection
• Ch 12 · Cross-Site Scripting (XSS) and Content Security Policy
• Ch 13 · CSRF, Clickjacking, and Browser Security Headers
• Ch 14 · File Uploads, Insecure Deserialization, and XXE

PART IV — DATA PROTECTION AND SECURE DESIGN

• Ch 15 · A02 Cryptographic Failures: TLS, Password Hashing, and Encryption at Rest
• Ch 16 · Secrets Management and Key Handling
• Ch 17 · A04 Insecure Design: Business Logic Flaws and Secure Design Patterns
• Ch 18 · A10 Server-Side Request Forgery (SSRF)
• Ch 19 · API Security: The OWASP API Security Top 10 in Practice

PART V — CONFIGURATION, SUPPLY CHAIN, AND OPERATIONS

• Ch 20 · A05 Security Misconfiguration: Defaults, Errors, Cloud, and Containers
• Ch 21 · A06 Vulnerable and Outdated Components: Dependencies, SCA, and SBOMs
• Ch 22 · A08 Software and Data Integrity Failures: CI/CD Security and Signing
• Ch 23 · A09 Security Logging and Monitoring Failures: Detection and Response
• Ch 24 · Security Testing: SAST, DAST, Dependency Scanning, and Code Review
• Ch 25 · Secure SDLC and DevSecOps: Building Security into Every Stage

PART VI — CASE STUDIES AND EMERGING RISKS

• Ch 26 · Case Study: A Full Security Review of Lattice Learn
• Ch 27 · Case Study: Hardening the Lattice Learn Public API
• Ch 28 · Securing AI-Powered Features: Prompt Injection, Data Leakage, and Excessive Agency

APPENDICES

• App A · OWASP Top 10 Cheat Sheet
• App B · Secure Code Templates and Reference
• App C · Pre-Release Security Checklist
• App D · Glossary

WHO IT IS FOR
Web, backend, and frontend developers who want to write secure code by default, plus tech leads, architects, and DevOps engineers responsible for secure design, reviews, and pipelines.

FORMAT
PDF (A4), 454 pages, English, clickable table of contents and PDF bookmarks. 1st Edition, 2026. Published by thenexbooks. Not affiliated with or endorsed by the OWASP Foundation.

Book details