In this module the Kladde has gained a lot of security: sign-in, roles, denying as the normal case, permissions tests, antiforgery, security headers. But is that everything? Which attacks is it still open to? There's a proven list for that question: the OWASP Top 10. In this lesson you go through it category by category on the Kladde and write down what the Kladde does and where that's backed up. You close two gaps along the way: the public booking can still be submitted as often as anyone likes, and nobody checks whether the Kladde's packages have known security holes.
The OWASP Top 10
The OWASP Foundation (Open Worldwide Application Security Project) is an open community that collects knowledge about secure software and publishes it freely. Its best-known document is the Top 10: the ten most important risks of web apps, reassessed every few years from the data of many tested applications and a survey of experts. The current edition is the one from 2025. The list is not a standard and not an exam you "pass". It's a checklist you use to go through your own app systematically.
The category names are in English; the explanations here are our own:
| No. | Category | In short |
|---|---|---|
| A01 | Broken Access Control | Someone can do something they shouldn't be able to. |
| A02 | Security Misconfiguration | A setting is too open: error details, default accounts, missing headers. |
| A03 | Software Supply Chain Failures | A part you didn't write yourself is vulnerable or tampered with: packages, tools, the pipeline. |
| A04 | Cryptographic Failures | Data is not, or badly, protected on the way or at rest. |
| A05 | Injection | Input is read as a command: SQL, HTML, shell. |
| A06 | Insecure Design | The design itself has the hole, for example a function nobody limits. |
| A07 | Authentication Failures | Signing in can be bypassed, guessed or taken over. |
| A08 | Software or Data Integrity Failures | Code or data is believed without checking where it comes from. |
| A09 | Security Logging & Alerting Failures | An attack happens and nobody sees it, because nothing is logged or reported. |
| A10 | Mishandling of Exceptional Conditions | An error or special case opens a door instead of closing it. |
A01 has been at the top for years. You did most against it in lessons 2.6.3 and 2.6.4. A10 is new in this edition and fits a rule the Kladde has followed since lesson 2.6.1: better that a wrongly configured app doesn't start at all than that it runs wide open.