Web Security & WAF interview question · Most asked
What is the OWASP Top 10 and which risks does it currently highlight?
Summary
The OWASP Top 10 is a consensus list of the most critical web application security risks. The 2025 edition lists: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.
Longer Answer
Broken access control remains #1 (SSRF is now folded into it), supply-chain risk got its own category, and error handling that fails open is newly called out. The 2021 edition is still widely referenced (it listed Vulnerable and Outdated Components and SSRF separately). OWASP also publishes an API Security Top 10 (BOLA, broken authentication, broken object property level authorization, unrestricted resource consumption, …) and a Top 10 for LLM applications (prompt injection, sensitive information disclosure, excessive agency, …). Use them as awareness checklists, not a complete security program.
Key Points
- Broken access control is #1
- Supply chain failures now a category
- Injection includes XSS
- API and LLM Top 10 lists exist
- Awareness, not a full program
More most-asked Web Security & WAF questions
- What is SQL injection and how do you prevent it?
- What is Cross-Site Scripting (XSS) and how do you prevent it?
- What is CSRF and how do you defend against it?
- What is a Web Application Firewall (WAF), and what can and can't it do?
- How do rate-limiting algorithms work (fixed window, sliding window, token bucket)?
- What is SSRF (Server-Side Request Forgery) and how do you prevent it?