WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 9, 2026 • Session details

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

Delaying dependency updates by 48 hours can save your web app from zero-day malware. Master this and other game-changing architectural defenses from the 2025 OWASP Top Ten.

Pause
Mute Enter Fullscreen
#1 about 7 min

Overview of the 2025 OWASP Top Ten list

Understanding the core purpose and structural changes of the updated web application security awareness document.

#2 about 2 min

Preventing broken access control and mass assignment

How parameter manipulation and automatic model binding lead to unauthorized data modification.

#3 about 2 min

Addressing security misconfiguration via HTTP headers

Securing web applications effortlessly by configuring strict referral policies and browser security headers.

#4 about 2 min

Mitigating risks in the software supply chain

Balancing immediate vulnerability patching with delayed dependency updates to avoid malicious package versions.

#5 about 5 min

Fixing cryptographic failures by enforcing encrypted transport

Protecting data in transit by fully adopting strict transport security and secure cookie flags.

#6 about 2 min

Handling modern injection flaws and cross-site scripting

Defeating JavaScript injection attacks through proper output escaping and strict content security policies.

#7 about 3 min

Addressing insecure design through early threat modeling

Implementing security from the start by utilizing reference architectures and shifting security practices left.

#8 about 2 min

Securing token signatures and preventing authentication failures

Avoiding critical authentication flaws by using strong cryptographic secrets and secure session management patterns.

#9 about 2 min

Maintaining software and data integrity during execution

Protecting runtime execution against tampering by strictly verifying data types and utilizing subresource integrity hashes.

#10 about 2 min

Establishing active processes for logging and alerting

Transforming passive log collection into proactive security monitoring by implementing automated anomaly detection and escalation chains.

#11 about 2 min

Securing applications against exceptional condition mishandling

Preventing sensitive information leakage and resource exhaustion by properly managing application exceptions and stack traces.

#12 about 1 min

Identifying missing security risks beyond the top ten

Evaluating additional emerging threats like artificial intelligence prompt injection and excessive resource consumption vulnerabilities.

#13

Fixing model mass assignment vulnerabilities in code

Remediating unauthorized data binding using dedicated view models or private property setters.

Matching moments

12:11 min

Identifying and mitigating top software vulnerability classes

Thomas Konrad · World Congress 2021

1:38 min

Overview of the OWASP API security top ten

Christian Wenz Christian Wenz · World Congress 2025

1:08 min

Overview of the OWASP MCP top ten vulnerabilities

Jose Manuel Ortega Jose Manuel Ortega · Europe 2026 Virtual

48 sec

Overview of five common software security pitfalls

Alexander Pirker · World Congress 2022

1:28 min

Identifying common security vulnerabilities via the OWASP project

Ramona Schwering Ramona Schwering · World Congress 2024

6:43 min

Implementing seven essential steps for modern web security

Bartosz Pietrucha · JS Congress

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
3 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
3 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
3 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
3 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
3 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
3 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Related videos

Bullet-Proof APIs: The OWASP API Security Top Ten thumbnail
25:46
World Congress 2025 • about 1 year ago

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
World Congress 2023 • about 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
World Congress 2022 • over 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.