1---2name: moai-ref-owasp-checklist-23description: OWASP Top 10 security checklist, authentication patterns, input validation, and HTTP security headers reference. Agent-extending skill that amplifies backend-implementation and security-audit workflows with production-grade security patterns. NOT for: frontend UI, DevOps deployment, performance optimization, testing strategy.4---56# OWASP Security Checklist Reference78## Target Agents910- `manager-develop` - Applies checklist during backend API implementation (`cycle_type=tdd` or `cycle_type=ddd` context)11- `/moai review` with a security focus - Primary security-audit invocation surface; equivalently available as a per-spawn `Agent(general-purpose)` security specialist per `archived-agent-rejection.md` §C1213## OWASP API Security Top 101415| Rank | Vulnerability | Check | Defense |16|------|-------------|-------|---------|17| A1 | **BOLA** (Broken Object Level Authorization) | Can user A access user B's resources? | Verify object ownership at every endpoint |18| A2 | **Broken Authentication** | Weak passwords, unlimited login attempts? | bcrypt (cost 12+), rate limit, MFA |19| A3 | **Broken Object Property Level Authorization** | Are hidden fields exposed in responses? | Response DTOs, field-level filtering |20| A4 | **Unrestricted Resource Consumption** | Can mass requests crash the server? | Rate limiting, enforce pagination limits |21| A5 | **Broken Function Level Authorization** | Can regular users call admin APIs? | RBAC middleware, permission checks |22| A6 | **Unrestricted Access to Sensitive Business Flows** | Can a sensitive flow be automated or abused in bulk? | Flow-level rate limits, anomaly detection, challenge on abuse signals |23| A7 | **SSRF** (Server-Side Request Forgery) | Can URL input reach internal or metadata endpoints? | Egress allowlist, block internal/metadata ranges, validate fetch targets |24| A8 | **Security Misconfiguration** | Debug mode, verbose errors, or default accounts exposed? | Production-hardened config, security headers, inspect deployed config |25| A9 | **Improper Inventory Management** | Undocumented, shadow, or old-version endpoints reachable? | Maintain an API inventory; deprecate and decommission old versions |26| A10 | **Unsafe API Consumption** | Are external API responses trusted blindly? | Validate external responses, set timeouts |2728## Authentication Checklist2930### Password Policy31- Minimum 8 characters, show strength meter (not strict rules)32- bcrypt (cost factor 12+) or Argon2id33- Temporary lock after 5 failed attempts (15 min) or CAPTCHA34- Prevent reuse of last 5 passwords3536### JWT Configuration37| Setting | Recommended Value |38|---------|------------------|39| Access Token Expiry | 15-30 minutes |40| Refresh Token Expiry | 7-14 days |41| Algorithm | RS256 (asymmetric) or HS256 |42| Storage | httpOnly + secure + sameSite cookie |43| Payload | Minimal: userId, role only (no PII) |44| Renewal | Silent refresh or token rotation |4546### Session Security47- Regenerate session ID after login48- Invalidate session on logout (server-side)49- Set session timeout (30 min idle)50- Bind session to IP/User-Agent (optional, strict)5152## HTTP Security Headers5354| Header | Value | Purpose |55|--------|-------|---------|56| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` | Force HTTPS |57| `X-Content-Type-Options` | `nosniff` | Prevent MIME sniffing |58| `X-Frame-Options` | `DENY` or `SAMEORIGIN` | Prevent clickjacking |59| `Content-Security-Policy` | `default-src 'self'` | Prevent XSS |60| `Referrer-Policy` | `strict-origin-when-cross-origin` | Limit referrer |61| `Permissions-Policy` | `camera=(), microphone=()` | Restrict browser features |6263## Input Validation Checklist6465| Type | Method | Tool |66|------|--------|------|67| Schema validation | Type + structure check | Zod, Joi, pydantic, Go validator |68| Length limits | Min/max constraints | Schema definitions |69| SQL Injection | Parameterized queries | ORM (Prisma, GORM, SQLAlchemy) |70| XSS Prevention | HTML escaping | DOMPurify (client), server escape |71| Path Traversal | Path normalization | filepath.Clean + whitelist |72| File Upload | Type + size validation | MIME type + magic number check |73| CORS | Origin whitelist | Never `origin: '*'` with credentials |7475## Sensitive Data Handling7677| Data Type | Storage | Transmission | Logging |78|----------|---------|-------------|---------|79| Passwords | bcrypt hash only | HTTPS only | NEVER |80| API Keys | Environment variables | Header (Authorization) | Masked (first 4 chars) |81| PII | Encrypted (AES-256) | HTTPS only | Masked |82| Credit Cards | Tokenized (payment provider) | Provider SDK | NEVER |83| Sessions | httpOnly cookie | HTTPS only | NEVER |8485## Security Review Severity Levels8687| Level | Label | Action | Example |88|-------|-------|--------|---------|89| P0 | CRITICAL | Block release | SQL injection, auth bypass |90| P1 | HIGH | Fix before merge | Missing authorization check |91| P2 | MEDIUM | Fix within sprint | Weak password policy |92| P3 | LOW | Track in backlog | Missing security header |9394## Trust Boundary Verification Principles9596| Principle | Applies To | Defense |97|-----------|------------|---------|98| Cached/client-supplied session state is not proof of current identity | Any framework caching or locally decoding a session/JWT value | Re-verify identity against the server-side source of truth (session store, token introspection, identity provider) before every authorization decision |99| Edge/gateway/middleware auth checks are a UX convenience, not a security boundary | Reverse proxies, framework middleware, API gateways, serverless edge functions | Every mutation-handling endpoint independently re-checks authentication AND resource-ownership authorization |100| Scheduled/cron-triggered HTTP endpoints are still public URLs | Any scheduler that invokes an HTTP endpoint (cron jobs, scheduled serverless functions, container-orchestrator scheduled jobs) | Require a shared-secret bearer check (constant-time compare) on every scheduled-endpoint invocation |101| Production builds must not expose source maps or equivalent debug artifacts | Any bundler/build tool | Disable production source maps, verbose stack traces, and build manifests in production configuration |102| Webhook receivers must verify a signature/HMAC header before trusting the payload | Any webhook provider | Verify signature/HMAC against a shared secret before treating the payload as legitimate business data |103104<!-- moai:evolvable-start id="rationalizations" -->105## Common Rationalizations106107| Rationalization | Reality |108|---|---|109| "This is an internal application, OWASP does not apply" | Internal applications are reachable from compromised internal services. OWASP applies to all web applications. |110| "The framework handles XSS protection" | Frameworks protect default rendering paths. Dynamic HTML insertion, innerHTML, and template literals bypass the protection. |111| "We do not store sensitive data, so encryption is unnecessary" | Session tokens, API keys, and PII are sensitive data. If the application has users, it has sensitive data. |112| "Security headers are just defense-in-depth, not critical" | Each security header blocks a specific attack class. Missing CSP enables XSS even when output is escaped. |113| "I will do a security review before release" | Late security reviews find issues that are expensive to fix. Secure coding practices prevent them from the start. |114115<!-- moai:evolvable-end -->116117<!-- moai:evolvable-start id="red-flags" -->118## Red Flags119120- User input rendered in HTML without escaping or sanitization121- SQL query built with string concatenation instead of parameterized queries122- Authentication token stored in localStorage instead of httpOnly cookie123- Missing Content-Security-Policy header on response124- Secrets (API keys, passwords) found in source code or configuration files committed to git125126<!-- moai:evolvable-end -->127128<!-- moai:evolvable-start id="verification" -->129## Verification130131- [ ] OWASP Top 10 checklist reviewed for the change (show which items were evaluated)132- [ ] User input sanitized before rendering in HTML output133- [ ] All database queries use parameterized statements134- [ ] Security headers present (CSP, X-Frame-Options, X-Content-Type-Options)135- [ ] No secrets found in source code (show grep results for common secret patterns)136- [ ] Authentication tokens use httpOnly, Secure, SameSite cookie attributes137138<!-- moai:evolvable-end -->
modu-ai