OWASP Proactive Controls
Description
Les 10 contrôles sécurité les plus critiques que tout développeur doit intégrer dès le départ dans chaque projet.
Les 10 contrôles
- C1 — Define Security Requirements
- C2 — Leverage Security Frameworks and Libraries
- C3 — Secure Database Access (parameterized queries, least privilege)
- C4 — Encode and Escape Data (context-aware)
- C5 — Validate All Inputs (server-side)
- C6 — Implement Digital Identity (MFA/FIDO2, sessions)
- C7 — Enforce Access Controls (server-side, RBAC)
- C8 — Protect Data Everywhere (TLS 1.3, AES-256 at rest)
- C9 — Implement Security Logging and Monitoring
- C10 — Handle All Errors and Exceptions Securely
Bibliothèques recommandées 2026
| Fonction | Node.js/TS | Python | PHP |
|---|---|---|---|
| Auth | NextAuth.js, Passport | Django Auth, Authlib | CodeIgniter Shield |
| Hash | bcrypt, argon2 | passlib (argon2) | password_hash() |
| Validation | zod, joi | pydantic, marshmallow | CI Validation |
| CSRF | csrf (npm) | Django CSRF | CI CSRF |
| SQLi | Prisma, Drizzle | SQLAlchemy | Query Builder |
| XSS | DOMPurify | bleach, MarkupSafe | htmlspecialchars |
| Crypto | Node.js crypto | cryptography (pyca) | OpenSSL |
Références
- OWASP Proactive Controls
- [[KNOW-REF-042]] — OWASP Top 10:2025
- [[KNOW-REF-045]] — Secure Coding Practices