OWASP Top 10 概覽

// A01: Broken Access Control — 正確的授權檢查
[HttpPut("api/orders/{id}")]
[Authorize]
public async Task<IActionResult> UpdateOrder(int id, UpdateOrderDto dto)
{
    var order = await _orderService.GetByIdAsync(id);
    if (order == null) return NotFound();
 
    // 關鍵：檢查這筆訂單是否屬於當前使用者
    var userId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    if (order.UserId.ToString() != userId)
        return Forbid(); // 403 — 不是你的訂單
 
    await _orderService.UpdateAsync(id, dto);
    return NoContent();
}
 
// A02: Cryptographic Failures — 正確的密碼 Hash
using BCrypt.Net;
 
public string HashPassword(string password)
    => BCrypt.Net.BCrypt.HashPassword(password, workFactor: 12);
 
public bool VerifyPassword(string password, string hash)
    => BCrypt.Net.BCrypt.Verify(password, hash);
 
// A05: Security Misconfiguration — 生產環境設定
if (app.Environment.IsProduction())
{
    app.UseHsts();
    app.UseExceptionHandler("/error"); // 不顯示詳細錯誤
}
app.UseHttpsRedirection();

// A03: Injection — 參數化查詢防止 SQL Injection
// 錯誤示範
// const query = `SELECT * FROM users WHERE id = ${req.params.id}`; // 危險！
 
// 正確做法
const user = await db.query("SELECT * FROM users WHERE id = $1", [req.params.id]);
 
// A06: Vulnerable Components — 自動掃描依賴漏洞
// package.json scripts:
// "audit": "npm audit --production",
// "audit:fix": "npm audit fix"
 
// A09: Logging — 記錄安全事件
app.post("/auth/login", async (req, res) => {
  const { email, password } = req.body;
  const user = await userService.findByEmail(email);
 
  if (!user || !await verifyPassword(password, user.passwordHash)) {
    // 記錄失敗的登入嘗試（安全事件）
    logger.warn("Failed login attempt", {
      email,
      ip: req.ip,
      userAgent: req.headers["user-agent"],
      timestamp: new Date().toISOString(),
    });
    return res.status(401).json({ error: "Invalid credentials" });
  }
 
  logger.info("Successful login", { userId: user.id, ip: req.ip });
  // ...
});

# A07: Authentication Failures — 安全的 Session 管理
from fastapi import FastAPI, Depends, HTTPException
from fastapi.security import HTTPBearer
 
# 密碼複雜度驗證
def validate_password(password: str) -> bool:
    if len(password) < 12:
        return False
    if not any(c.isupper() for c in password):
        return False
    if not any(c.isdigit() for c in password):
        return False
    if not any(c in "!@#$%^&*" for c in password):
        return False
    return True
 
# A04: Insecure Design — Rate Limiting 防暴力破解
from slowapi import Limiter
limiter = Limiter(key_func=get_remote_address)
 
@app.post("/auth/login")
@limiter.limit("5/minute")  # 每分鐘最多 5 次登入嘗試
async def login(request: Request, credentials: LoginDto):
    user = await authenticate(credentials.email, credentials.password)
    if not user:
        raise HTTPException(status_code=401, detail="Invalid credentials")
    return {"access_token": create_token(user)}
 
# A10: SSRF — 驗證 URL 防止存取內部資源
from urllib.parse import urlparse
import ipaddress
 
def is_safe_url(url: str) -> bool:
    parsed = urlparse(url)
    hostname = parsed.hostname
    if not hostname:
        return False
    try:
        ip = ipaddress.ip_address(hostname)
        return not (ip.is_private or ip.is_loopback)  # 禁止內部 IP
    except ValueError:
        return hostname not in ["localhost", "127.0.0.1", "0.0.0.0"]