OWASP Webshield Library
Practical, reusable OWASP Top 10 security controls for JavaScript applications: a framework-agnostic core library, adapters for React, Vue, Next.js and Express, and a framework-neutral server layer for Node.js.
2.0.0 Released ( V2.0.0) on 4 October 2026. Six packages ship together, all at 2.0.0:
@owasp-webshield/core and @owasp-webshield/react: upgraded from 1.0.0
@owasp-webshield/vue: first release, a Vue 3 adapter
@owasp-webshield/next: first release, a Next.js App Router adapter
@owasp-webshield/express: first release, Express 4 and 5 middleware
@owasp-webshield/node: first release, the framework-neutral server layer
Also in 2.0.0: TypeScript declarations for every package, and security fixes across access control, injection, authentication, data integrity and SSRF.
2.0.0 is a major release. Check these changes before you upgrade:
Password-based keys: the default PBKDF2 work factor is now 600,000 iterations, so keys derived with the 1.x default come out different. Pass iterations: 210000 to decrypt existing data, then re-encrypt it.
CSRF in React: useSecureHttpClient() sends the server's XSRF-TOKEN cookie instead of making up a token in the browser.
Sanitizer output: text is no longer double-encoded, and the moderate profile drops class attributes unless you allow them by name with allowedClasses.
Install every OWL package at the same version.
1.0.0 (21 September 2026): the first release as @owasp-webshield/core and @owasp-webshield/react, with the full A01–A10 core API and the React adapter
All six packages are versioned together and published from GitHub Actions by a single version tag. Each package is published with npm provenance, so you can verify it was built from this repository. Before anything is published, the release runs the full test suite and installs every package into a clean project, the way users do.
Supported versions:
2.x: full security fixes
Found a vulnerability? Report it privately, following the security policy.
Project Resources
Project Resources
Requirements
- Requires Node.js 20 or above (core, React and Vue)
- Requires Node.js 20.19+ or 22.12+ (Node, Express and Next.js adapters)
- Requires React 18 or above (React and Next.js adapters)
- Requires Vue 3.3 or above (Vue adapter)
- Requires Next.js 14 or above (Next.js adapter)
- Requires Express 4.18 or above (Express adapter)
- Core, React and Vue also run in modern browsers
Slack