Top 10 2013-A2-Broken Authentication and Session Management

TEMPORARY PLACEHOLDER for 2013 T10

NOTE: THIS IS NOT THE LATEST VERSION. Please visit the OWASP Top 10 project page to find the latest edition.

[[Top 10 {{{year}}}-A1-Injection|← A1-Injection]]

[[Top 10 {{{year}}}-Table of Contents | {{{year}}} Table of Contents]] [[Top_10_{{{year}}}-Top 10|{{{year}}} Top 10 List]]

[[Top 10 {{{year}}}-Injection(XSS)|Injection(XSS) →]]

Threat Agents	Attack Vectors	Security Weakness		Technical Impacts	Business Impacts
Application Specific	Exploitability EASY	Prevalence COMMON	Detectability AVERAGE	Impact SEVERE	Application / Business Specific
blank.	blank	blank		blank	blank

Am I Vulnerable To 'Cross-Site Scripting (XSS)'? blank	How Do I Prevent 'Cross-Site Scripting (XSS)'? blank blankBullet1 blankBullet2
Example Attack Scenarios blank blank code blank http://example.com/app/accountView?id=' or '1'='1 blank	References OWASP OWASP SQL Injection Prevention Cheat Sheet ESAPI Encoder API External CWE Entry 77 on Command Injection CWE Entry 89 on SQL Injection

[[Top 10 {{{year}}}-Main|← Main]]

[[Top 10 {{{year}}}-Table of Contents | {{{year}}} Table of Contents]] [[Top_10_{{{year}}}-Top 10|{{{year}}} Top 10 List]]

[[Top 10 {{{year}}}-A2-Cross-Site Scripting (XSS)|A2-Cross-Site Scripting (XSS) →]]

---

© 2002-2013 OWASP Foundation This document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license. Some rights reserved. [[Category:OWASP Top Ten {{{year}}} Project]]

aaa Cross-Site Scripting (XSS) bbb