Backend Security & the OWASP Top 10

Why backend security is your job#

Every API you build is reachable by anyone on the internet — including attackers running automated scanners 24 hours a day. Frameworks help, but most real breaches come from a handful of predictable backend mistakes: weak authentication, missing authorization checks, injection, and leaked secrets.

The good news: if you understand the common risks, you can avoid most of them with habits, not heroics.

The OWASP Top 10#

The OWASP Top 10 is the industry's reference list of the most critical web application security risks. These are the categories every backend developer should recognise:

Authentication vs authorization#

Two words students often mix up:

• Authentication (AuthN) — who are you? Logging in with a password, a passkey, Google sign-in.
• Authorization (AuthZ) — what are you allowed to do? Can this user edit this post? Is this user an admin?

Most serious breaches are authorization bugs — the user is logged in, but the code forgets to check whether this user may access this record.

# Broken access control: any logged-in user can read any invoice
@app.get("/invoices/{invoice_id}")
def get_invoice(invoice_id: int, user = Depends(current_user)):
    return db.get_invoice(invoice_id)

# Fixed: scope the query to the current user
@app.get("/invoices/{invoice_id}")
def get_invoice(invoice_id: int, user = Depends(current_user)):
    invoice = db.get_invoice(invoice_id)
    if invoice is None or invoice.owner_id != user.id:
        raise HTTPException(status_code=404)      # 404 avoids revealing that it exists
    return invoice

Core security principles#

1. Never trust client input. Validate type, length, format and range on the server — the frontend's validation is only for user experience.
2. Least privilege. Database users, API keys and services get only the permissions they need.
3. Defense in depth. Several independent layers (validation, auth, rate limits, monitoring) so one mistake isn't fatal.
4. Secure defaults. New endpoints should be private until made public deliberately.
5. Fail closed. If an authorization check errors, deny access.
6. Keep secrets out of code. Use environment variables or a secrets manager, never Git.

Security headers and HTTPS#

• Serve everything over HTTPS and enable HSTS (Strict-Transport-Security).
• Set cookies with Secure, HttpOnly and SameSite.
• Add Content-Security-Policy, X-Content-Type-Options: nosniff and a strict CORS policy (never * with credentials).

What you'll learn in this tutorial#

Common mistakes#

• Checking permissions only in the UI. Attackers call your API directly.
• Returning detailed stack traces in production. They reveal paths, queries and versions.
• Rolling your own crypto. Use well-reviewed libraries.
• Logging passwords, tokens or full card numbers. Logs leak too.

Key takeaways#

• The OWASP Top 10 is the checklist of the risks that matter most.
• Authentication proves identity; authorization decides access — check both on every request.
• Validate all input, apply least privilege, and keep secrets out of code.