OWASP Webshield Library
Practical, reusable OWASP Top 10 security controls for JavaScript applications: a framework-agnostic core library, adapters for React, Vue, Next.js and Express, and a framework-neutral server layer for Node.js.
Benchmarked against OWASP vulnerable apps
OWL is reviewed against OWASP NodeGoat and OWASP Juice Shop. For each documented weakness, the traceability matrix shows which OWL control addresses it, and which gaps remain.
NodeGoat: 10 of 20 in-scope weaknesses covered, 5 partially, 5 gaps
Juice Shop: 23 of 70 in-scope challenges covered, 17 partially, 30 gaps
The two benchmarks count different things (weaknesses and challenges), so their numbers are shown side by side and never added together.
Where OWL is strong, and where it isn't yet
Strong: XSS and NoSQL injection (A03), encryption at rest (A02), roles and CSRF (A01), SSRF (A10) and logging (A09)
Biggest gap: SQL injection (8 Juice Shop challenges) has no OWL answer today
Other gaps: ownership checks such as IDOR, path traversal and open redirects (A01); a password hash-and-verify API and JWT verification (A02); a built-in source of vulnerability advisories (A06)
These results come from a static code review of the OWL 1.0.0 core, not yet verified by running the attacks. Several gaps found then are addressed by the 2.0.0 server adapters, but they aren't re-scored yet:
Security headers and safe error responses (A05, the weakest category in the review): securityHeaders, securityHeadersConfig and errorHandler
Mass assignment (A08): validation with allowUnknownFields: false rejects fields the schema doesn't list
A full re-review with the 2.0.0 server adapters, verified by running each attack, is on the roadmap.
Project Resources
Project Resources
Requirements
- Requires Node.js 20 or above (core, React and Vue)
- Requires Node.js 20.19+ or 22.12+ (Node, Express and Next.js adapters)
- Requires React 18 or above (React and Next.js adapters)
- Requires Vue 3.3 or above (Vue adapter)
- Requires Next.js 14 or above (Next.js adapter)
- Requires Express 4.18 or above (Express adapter)
- Core, React and Vue also run in modern browsers
Slack