OWASP Top 10 2025: zaschita veb-prilozheniy

OWASP Top 10 — standartnyy spisok kriticheskih uyazvimostey veb-prilozheniy. Razberyom aktualnye ugrozy i metody zaschity.

1. Broken Access Control

Nepravilnaya proverka prav dostupa — samaya rasprostranyonnaya uyazvimost.

Zaschita v Laravel:

// Proverka politik$this->authorize('update', $post);

// Middleware dlya roleyRoute::middleware(['role:admin'])->group(function () { });

2. Cryptographic Failures

Nebezopasnoe hranenie chuvstvitelnyh dannyh. Ispolzuyte strong encryption i heshiruyte paroli.

3. Injection (SQL, NoSQL, Command)

Laravel Eloquent zaschischaet ot SQL Injection po umolchaniyu cherez prepared statements.

// BezopasnoUser::where('email', $email)->first();

// Opasno — nikogda ne delayte tak!DB::select("SELECT * FROM users WHERE email = '$email'");

4. Insecure Design

Arhitekturnye oshibki: otsutstvie rate limiting, nebezopasnye business logic.

5. Security Misconfiguration

Standartnye paroli, otkrytye debug-rezhimy, lishnie HTTP-metody.

6. Vulnerable Components

Ustarevshie zavisimosti. Ispolzuyte composer audit i npm audit.

Security Headers

Obyazatelnye zagolovki:

• Content-Security-Policy
• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Strict-Transport-Security (HSTS)