OWASP Webshield Library
Practical, reusable OWASP Top 10 security controls for JavaScript applications: a framework-agnostic core library, adapters for React, Vue, Next.js and Express, and a framework-neutral server layer for Node.js.
Vue adapter: composables, v-safe-html and a Vue Router guard
Next.js adapter: App Router route-handler guards, middleware CSRF, page security headers, and sessions for Server Components and Server Actions
Express adapter and the framework-neutral Node.js server layer, so every rule can be enforced on the server
TypeScript declarations for every package
One release for all six packages, published with npm provenance
Angular adapter (@owasp-webshield/angular): route guards, HTTP interceptors for CSRF and token handling, and a sanitizing pipe
Runtime-verified benchmarks: a re-review of NodeGoat and Juice Shop with the 2.0.0 server adapters, verified by running each attack
Closing the biggest benchmark gaps: SQL injection, ownership checks (IDOR), and password hashing with a verify API
Browser-capable encryption with an async Web Crypto API
A reusable CI security-gate GitHub Action, built on the npm audit-backed dependency scanner
Want to take one of these on? Open an issue or start a discussion first, so the design can be agreed before you build it
Project Resources
Project Resources
Requirements
- Requires Node.js 20 or above (core, React and Vue)
- Requires Node.js 20.19+ or 22.12+ (Node, Express and Next.js adapters)
- Requires React 18 or above (React and Next.js adapters)
- Requires Vue 3.3 or above (Vue adapter)
- Requires Next.js 14 or above (Next.js adapter)
- Requires Express 4.18 or above (Express adapter)
- Core, React and Vue also run in modern browsers
Slack