moai-ref-owasp-checklist

Walk each of the ten vulnerability classes in the checklist, from BOLA to unsafe API consumption, and verify the listed check for every endpoint. The skill pairs each vulnerability with a concrete defense such as object ownership verification, rate limiting, or URL whitelisting.

Use a 15-30 minute access token expiry, 7-14 day refresh token expiry, and RS256 or HS256 algorithms. Store tokens in httpOnly, secure, sameSite cookies and keep payloads minimal with only userId and role, excluding PII.

Include Strict-Transport-Security, X-Content-Type-Options set to nosniff, X-Frame-Options set to DENY or SAMEORIGIN, Content-Security-Policy, Referrer-Policy, and Permissions-Policy. Each header blocks a specific attack class such as clickjacking, MIME sniffing, or XSS.

Hash passwords with bcrypt at cost factor 12 or higher, or use Argon2id. Enforce a minimum of 8 characters, lock accounts temporarily after 5 failed attempts, and prevent reuse of the last 5 passwords.

The checklist is scoped to backend security, authentication, and input validation. It does not cover frontend UI concerns, DevOps deployment, performance optimization, or testing strategy, so use domain-specific guidance for those areas.