WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 9, 2026 • Session details

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

Delaying dependency updates by 48 hours can save your web app from zero-day malware. Master this and other game-changing architectural defenses from the 2025 OWASP Top Ten.

Pause
Mute Enter Fullscreen
#1 about 7 min

Overview of the 2025 OWASP Top Ten list

Understanding the core purpose and structural changes of the updated web application security awareness document.

#2 about 2 min

Preventing broken access control and mass assignment

How parameter manipulation and automatic model binding lead to unauthorized data modification.

#3 about 2 min

Addressing security misconfiguration via HTTP headers

Securing web applications effortlessly by configuring strict referral policies and browser security headers.

#4 about 2 min

Mitigating risks in the software supply chain

Balancing immediate vulnerability patching with delayed dependency updates to avoid malicious package versions.

#5 about 5 min

Fixing cryptographic failures by enforcing encrypted transport

Protecting data in transit by fully adopting strict transport security and secure cookie flags.

#6 about 2 min

Handling modern injection flaws and cross-site scripting

Defeating JavaScript injection attacks through proper output escaping and strict content security policies.

#7 about 3 min

Addressing insecure design through early threat modeling

Implementing security from the start by utilizing reference architectures and shifting security practices left.

#8 about 2 min

Securing token signatures and preventing authentication failures

Avoiding critical authentication flaws by using strong cryptographic secrets and secure session management patterns.

#9 about 2 min

Maintaining software and data integrity during execution

Protecting runtime execution against tampering by strictly verifying data types and utilizing subresource integrity hashes.

#10 about 2 min

Establishing active processes for logging and alerting

Transforming passive log collection into proactive security monitoring by implementing automated anomaly detection and escalation chains.

#11 about 2 min

Securing applications against exceptional condition mishandling

Preventing sensitive information leakage and resource exhaustion by properly managing application exceptions and stack traces.

#12 about 1 min

Identifying missing security risks beyond the top ten

Evaluating additional emerging threats like artificial intelligence prompt injection and excessive resource consumption vulnerabilities.

#13

Fixing model mass assignment vulnerabilities in code

Remediating unauthorized data binding using dedicated view models or private property setters.

Matching moments

12:11 min

Identifying and mitigating top software vulnerability classes

Thomas Konrad · WWC 2021

1:38 min

Overview of the OWASP API security top ten

Christian Wenz Christian Wenz · WWC 2025

48 sec

Overview of five common software security pitfalls

Alexander Pirker · WWC 2022

1:28 min

Identifying common security vulnerabilities via the OWASP project

Ramona Schwering Ramona Schwering · WWC 2024

6:43 min

Implementing seven essential steps for modern web security

Bartosz Pietrucha · JS Congress

2:43 min

Understanding common web application vulnerabilities and risks

Jakub Andrzejewski · WWC 2023

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
about 1 month ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
about 1 month ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
about 1 month ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
about 1 month ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
about 1 month ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
about 1 month ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp

Related videos

Bullet-Proof APIs: The OWASP API Security Top Ten thumbnail
25:46
WWC 2025 • 12 months ago

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
WWC 2023 • almost 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Software Security 101: Secure Coding Basics thumbnail
1:58:48
WWC 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

101 Typical Security Pitfalls thumbnail
28:41
WWC 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 5 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
WWC 2022 • about 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.