OWASP Webshield Library

OWASP Webshield Library (OWL) is an open source security library for JavaScript applications. It packages common defenses (access control, input validation and sanitization, CSRF protection, SSRF blocking, encryption, secure session handling and redacted logging) as tested, reusable modules, each named after the OWASP Top 10 category it addresses.

JavaScript developers on React, Vue, Next.js, Express or plain Node.js who want security controls they don't have to write from scratch

All six packages are released together, with the same version number:

• @owasp-webshield/core: every A01–A10 module, for any JavaScript app, with no runtime dependencies

• @owasp-webshield/react: OwlProvider, AuthGate, PermissionGate, SanitizedText, useSecureHttpClient and hooks for every category

• @owasp-webshield/vue: plugin and composables, v-safe-html (a sanitizing replacement for v-html) and a Vue Router guard

• @owasp-webshield/next: withOwl() route-handler guard, middleware CSRF, next.config.js security headers, and sessions for Server

Components and Server Actions

• @owasp-webshield/express: middleware for auth, permissions, CSRF, validation, security headers, SSRF checks and error handling

• @owasp-webshield/node: the framework-neutral server functions the Express and Next.js adapters are built on

• A01 Broken Access Control: RBACManager, ACLManager, PermissionChecker. Server: requirePermission, withOwl({ permission })

• A02 Cryptographic Failures: CryptoManager, PBKDF2Adapter, Argon2Adapter, SecretPolicy

• A03 Injection: InputSanitizer, InputValidator. Server: validate, sanitizeBody, withOwl({ body, query })

• A04 Insecure Design: ThreatModelGuard, DesignChecklist

• A05 Security Misconfiguration: SecurityConfigManager, HardeningReporter. Server: securityHeaders, assertHardened, securityHeadersConfig

• A06 Vulnerable & Outdated Components: DependencyRiskScanner, ComponentPolicy

• A07 Identification & Authentication Failures: AuthManager, TokenManager. Server: requireAuth, withOwl({ auth }), createServerAuth

• A08 Software & Data Integrity Failures: CSRFTokenManager, HTTPClient. Server: csrfProtection, guardCsrf, withOwl({ csrf })

• A09 Security Logging & Monitoring Failures: SecurityLogger, EventEmitter. Server: errorHandler({ logger })

• A10 Server-Side Request Forgery: SSRFGuard, SafeFetcher. Server: guardOutboundUrl, withOwl({ outboundUrl })