Skip to content

The threat map: OWASP Top 10:2025, API Security Top 10:2023 and baseline headers

Name the class first; most of the top classes are logic a scanner cannot see.

Predict first

Before you read: predict

During ECON-201, Mia, signed in to ExamHall with her own account, opens her submitted attempt at /attempts/77/review. She edits the address to /attempts/78/review; the server reads 78 as an attempt number, loads that attempt and shows her Omar's answers.

Under the OWASP Top 10:2025, which category does this defect belong to?

Pick one

The 30-second version

The OWASP Top 10 is a ranked list of risk categories, not a list of bugs to scan for: each category is a family of weaknesses, and a defect belongs to the family of its root cause. Access control leads the 2025 list, and the API list opens with object-level authorization. A few response headers close cheap gaps.

Name the class first; most of the top classes are logic a scanner cannot see.

How it works

Step 1 of 15

Categories, not bugs. Each entry groups many weaknesses (CWEs) under one root cause; you file a defect under its cause.
In the kitchen
  • "failing to give way" groups thousands of crashes with one cause → a category groups many CWEs (step 1)

Analogy: A national road-safety report (road safety)

The report ranks causes of crashes, not single crashes, from police records and a survey of crash investigators.

In the road-safety report On the threat map
"failing to give way" groups thousands of crashes with one cause a category groups many CWEs (step 1)
causes ranked from police records, plus two investigators say records miss eight from data, two from the survey (step 2)
a speed camera catches speeding and never "failed to look" a scanner finds little access-control or design flaw (step 8)
seat belts and mirrors fitted to every car at the factory baseline headers on every response (step 11)

In real terms: a finding is filed under its cause, and the top causes are found by people reading code.

Breaks down when: a report's causes rarely change in a year. OWASP's categories merge and move between editions (steps 4–5), so cite the edition.

Examples, run for real

4.1 ExamHall EXH-3770: a header check over the exam page

ExamHall's exam page went out with no baseline header and with X-Powered-By: Express; any site could frame it. MR !4070 adds the four headers and drops X-Powered-By. The check reads one response; Chromium frames the page from a third-party origin:

4.1 before MR !4070: Strict-Transport-Security absent · X-Content-Type-Options: nosniff absent · CSP frame-ancestors absent · Referrer-Policy absent · 0 of 4 present · x-powered-by present · framed by a third-party page: shown
4.1 after MR !4070: Strict-Transport-Security present · X-Content-Type-Options: nosniff present · CSP frame-ancestors present · Referrer-Policy present · 4 of 4 present · x-powered-by absent · framed by a third-party page: refused

frame-ancestors 'self' now refuses the third-party frame (step 11). The check finds what is missing on one response; it finds no access-control flaw (step 8).

4.2 Ticketing: what a linked site learns

A box office's order page sits at /orders/5521?code=K7Q2 and links to a parking site. Chromium follows the link:

4.2 order page /orders/5521?code=K7Q2, no Referrer-Policy: the parking site receives Referer <box office origin>/
4.2 same page with Referrer-Policy: no-referrer: the parking site receives Referer (none)

The default already kept the path and code at home (step 14); setting the policy states that intent instead of trusting each browser's default.

Try it

Answer first, then check. Nothing is saved.

Question 1 of 7

A box office's MR changes three files of its API, where one Node process serves every fan during an on-sale.

Which change should the review block?

Pick one

Question 2 of 7

A box office serves its seat picker at /seats with two response headers: X-Frame-Options set to DENY, and Content-Security-Policy set to frame-ancestors 'self' https://tours.partner.test. Three pages frame /seats in an <iframe>: the box office's own home page, the partner, https://tours.partner.test, and a fan blog.

In Chromium, which frames show the seat picker?

Pick one

Question 3 of 7

A box office's API serves GET /api/events/9 to every signed-in user, and only organisers are meant to delete events. Ola, a fan signed in with her own token, sends DELETE /api/events/9, and the event is deleted.

Under the OWASP API Security Top 10:2023, which risk is this?

Pick one

Question 4 of 7

ExamHall's question editor lets an author give an image's web address; ExamHall's server then downloads the image from that address and stores it. A review finds that the server fetches any address it is given, including hosts on ExamHall's private network.

Under the OWASP Top 10:2025, which category files this defect?

Pick one

Question 5 of 7

An interviewer asks: "Walk me through ExamHall's surfaces (the candidate app, the proctor console, the admin pages, the outgoing grade webhooks and the file uploads) and tell me which Top 10:2025 category you would check first on each, and why." Answer in at most 150 words.

Write one line per surface.

Question 6 of 7

A box office has two pages a fan blog tries to frame. The checkout page's HTML <head> holds <meta http-equiv="X-Frame-Options" content="DENY"> and <meta http-equiv="Content-Security-Policy" content="frame-ancestors 'none'">, and the page sends neither as a response header. The account page holds no framing tag in its HTML and sends X-Frame-Options with the value DENY as a response header.

In Chromium, which pages show inside the blog's frames?

Pick one

Question 7 of 7

ExamHall's build installs its packages fresh on every run. One morning it installs a new release of a date-formatting library that its maintainer never wrote: someone had taken over the maintainer's registry account and published it.

Under the OWASP Top 10:2025, which category files this?

Pick one

Go deeper

Pro tip
  1. When asked "which of the Top 10 have you fixed?", answer with a category, the defect and the test that proves the fix. When: any security question in a behavioural or design round. Status: SELF (this lesson's practice target; not run).
Source

OWASP's lists change between editions: valid as of 2026-10-13.

  • OWASP Top 10:2025 (the row's first source), https://top10.owasp.org/2025/ (top10-2025-index.txt): "The OWASP Top 10 is a standard awareness document for developers and web application security." (step 1); "A06:2025 - Insecure Design"; "A10:2025 - Mishandling of Exceptional Conditions".
  • OWASP Top 10:2025, Introduction, https://top10.owasp.org/2025/0x00_2025-Introduction/ (top10-2025-intro.txt): "As indicated by the dashed line in the above figure, Server-Side Request Forgery (SSRF) has been rolled into this category."; "A03:2025 - Software Supply Chain Failures is an expansion of A06:2021-Vulnerable and Outdated Components" (step 5); "Therefore, we only pick eight of the ten categories from the data because it's incomplete." (step 2); "The results in the data are largely limited to what the industry can test for in an automated fashion." (step 8); "A10:2025 - Mishandling of Exceptional Conditions is a new category for 2025." (step 5).
  • OWASP Top 10:2025, A01 Broken Access Control, https://top10.owasp.org/2025/A01_2025-Broken_Access_Control/ (top10-2025-a01.txt): "Permitting viewing or editing someone else's account by providing its unique identifier (insecure direct object references)" (step 3; t1); "Elevation of privilege. Acting as a user without being logged in or or gaining privileges beyond those expected of the logged in user (e.g. admin access)." (step 3; t2); "Model access controls should enforce record ownership rather than allowing users to create, read, update, or delete any record." (t1's D); "CWE-918 Server-Side Request Forgery (SSRF)".
  • OWASP Top 10:2025, A02 Security Misconfiguration, https://top10.owasp.org/2025/A02_2025-Security_Misconfiguration/ (top10-2025-a02.txt): "The server does not send security headers or directives, or they are not set to secure values." (step 11).
  • OWASP Top 10:2025, A03 Software Supply Chain Failures, https://top10.owasp.org/2025/A03_2025-Software_Supply_Chain_Failures/ (top10-2025-a03.txt): "They are often caused by vulnerabilities or malicious changes in third-party code, tools, or other dependencies that the system relies on.".
  • OWASP Top 10:2025, A05 Injection, https://top10.owasp.org/2025/A05_2025-Injection/ (top10-2025-a05.txt): "An injection vulnerability is an application flaw that allows untrusted user input to be sent to an interpreter" and "causes the interpreter to execute parts of that input as commands".
  • OWASP Top 10:2025, A07 Authentication Failures, https://top10.owasp.org/2025/A07_2025-Authentication_Failures/ (top10-2025-a07.txt): "When an attacker is able to trick a system into recognizing an invalid or incorrect user as legitimate, this vulnerability is present." (t1's B, t2's A).
  • OWASP Top 10:2025, A10 Mishandling of Exceptional Conditions, https://top10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions/ (top10-2025-a10.txt): "or exceptions that are not handled at all, allowing the system to fall into an unknown and unpredictable state"; "CWE-636 Not Failing Securely ('Failing Open')" (step 6).
  • OWASP API Security Top 10, 2023 edition (the row's second source), https://owasp.org/API-Security/editions/2023/en/0x11-t10/ (api-top10-2023.txt), which now redirects to api-security.owasp.org: "API1:2023 - Broken Object Level Authorization" (step 9); "Compromising a system's ability to identify the client/user, compromises API security overall."; "the lack of or improper authorization validation at the object property level".
  • OWASP API Security Top 10 2023, API1 BOLA, https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ (api1-2023.txt): "In the case of BOLA, it's by design that the user will have access to the vulnerable API endpoint/function.".
  • OWASP API Security Top 10 2023, API2 Broken Authentication, https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ (api2-2023.txt): "Authentication endpoints and flows are assets that need to be protected.".
  • OWASP API Security Top 10 2023, API3 Broken Object Property Level Authorization, https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/ (api3-2023.txt): "API3:2023 Broken Object Property Level Authorization" (step 10).
  • OWASP API Security Top 10 2023, API5 Broken Function Level Authorization, https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/ (api5-2023.txt): "Can a user perform sensitive actions (e.g. creation, modification, or deletion ) that they should not have access to by simply changing the HTTP method (e.g. from GET to DELETE)?".
  • OWASP HTTP Security Response Headers Cheat Sheet (the row's third source), https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html (owasp-headers.txt): "Content Security Policy (CSP) frame-ancestors directive obsoletes X-Frame-Options for supporting browsers" (step 12); "Do not set this header or explicitly turn it off."; "Modern browsers default to strict-origin-when-cross-origin" and "Set the header explicitly rather than relying on browser defaults." (step 14); "X-Content-Type-Options: nosniff" and "instructs browsers to only access the website using HTTPS, even if a user attempts to connect over HTTP" (step 11). The meta-tag behaviour of step 13 is executed, not cited.

Related lessons

Checked against the tools and docs as of 2026-10-13.