moai-ref-owasp-checklist

Apply the OWASP API Security Top 10 checklist item by item, checking each endpoint for object-level authorization, authentication strength, injection defenses, and security misconfiguration. Classify each finding by severity from P0 (block release) to P3 (backlog).

Include Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY or SAMEORIGIN, Content-Security-Policy, Referrer-Policy, and Permissions-Policy. Each header blocks a specific attack class such as clickjacking, MIME sniffing, or XSS.

Use a 15-30 minute access token expiry, 7-14 day refresh token expiry, RS256 or HS256 algorithm, and store tokens in httpOnly, Secure, SameSite cookies. Keep the payload minimal with only userId and role, never PII.

Yes. Internal applications remain reachable from compromised internal services, so OWASP guidance applies to all web applications regardless of network exposure. The checklist explicitly rejects the rationalization that internal apps are exempt.

A checklist guides manual or agent-assisted review but does not execute penetration tests or runtime scanning. It covers common vulnerability classes and trust boundary principles, but specialized threats may require dedicated security tooling and testing.