OWASP Web Shield Library ( OWL )

OWASP Web Shield Library (OWL)

Practical, reusable OWASP Top 10 security controls for modern JavaScript applications.

What OWL Delivers

OWL maps reusable security controls directly to OWASP categories so teams speak the same security language as their threat models.

Core Module Map (A01–A10)

React Adapter Highlights

@owasp-webshield/react
 ├── A01  ACLProvider, RBACProvider, useACL, usePermission, PermissionGate
 ├── A02  useCryptoManager
 ├── A03  useInputSanitizer, SanitizedText
 ├── A04  useThreatModelGuard
 ├── A05  useHardeningReport
 ├── A06  useDependencyRiskScanner
 ├── A07  AuthProvider, useAuth, useAuthToken, AuthGate
 ├── A08  useSecureHttpClient, withSecurityHeaders
 ├── A09  SecurityProvider, useSecurityMonitoring, SecurityAlert
 └── A10  useSafeFetcher

OwlProvider composes the A01/A07/A09 providers above into one component; pair it with createOwlClient() from @owasp-webshield/core to build the managers it needs from one config object instead of wiring each by hand.

Project Links

Getting Started

Requirements

Install

# Install dependencies
npm install

# Verify the quality gate passes
npm run check

Core Usage — 5-minute example

import {
  ACLManager,
  AuthManager,
  PermissionChecker,
  RBACManager,
  TokenManager
} from "@owasp-webshield/core";

// 1. Set up auth and token management
const tokenManager = new TokenManager();
tokenManager.setTokens({ accessToken: "jwt", expiresAt: Date.now() + 3_600_000 });

const authManager = new AuthManager({ tokenManager });
authManager.setSession({ userId: "u1", roles: ["admin"] });

// 2. Define role permissions
const rbac = new RBACManager();
rbac.defineRole("admin", ["read:invoice", "update:invoice"]);

// 3. Add ACL policy overrides
const acl = new ACLManager();
acl.setPolicy("invoice", "delete", "deny");

// 4. Check combined permission (deny-overrides)
const checker = new PermissionChecker({ rbacManager: rbac, aclManager: acl });
console.log(checker.check({ role: "admin", action: "read", resource: "invoice" }));
// → { allowed: true, reason: "allowed", metadata: { ... } }

React Adapter — Provider Composition

import { createOwlClient } from "@owasp-webshield/core";
import { AuthGate, OwlProvider, PermissionGate } from "@owasp-webshield/react";

const owl = createOwlClient({ roles: { viewer: { permissions: ["read:reports"] } } });

export function AppShell({ children }) {
  return (
    <OwlProvider client={owl}>
      <AuthGate fallback={<div>Sign in required</div>}>
        <PermissionGate action="read" resource="reports"
          fallback={<div>Access denied</div>}>
          {children}
        </PermissionGate>
      </AuthGate>
    </OwlProvider>
  );
}

OwlProvider composes SecurityProvider/AuthProvider/ACLProvider/RBACProvider for you; wire them individually if you need managers built up separately.

Run the Examples

Node secrets-vault app (every OWASP category, no build required)

cd examples/owl-enabled-node-secrets-app
npm install && npm start

Full-featured React Todo app (every OWASP category, one product)

cd examples/owl-enabled-react-todo-app
npm install && npm run dev

Live demo: guileless-basbousa-a2bd63.netlify.app

Available Scripts

npm run check    # lint + test (full quality gate)
npm run test     # Jest unit tests only
npm run lint     # ESLint only
npm run build    # Build ESM + CJS outputs

CI/CD Baseline

- name: Install
  run: npm ci

- name: Quality gate
  run: npm run check

- name: Build
  run: npm run build

Further Reading

Contributing to OWL

Project Leader

Ways to Contribute

Quickstart

# 1. Fork and clone
git clone https://github.com/<you>/www-project-webshield-library.git
cd www-project-webshield-library

# 2. Install dependencies
npm install

# 3. Verify gate passes before any changes
npm run check

# 4. Create a branch
git checkout -b feature/your-change

# 5. Keep gate green throughout development
npm run check

# 6. Open a pull request against main

Pull Request Checklist

Before submitting, confirm all of the following:

• npm run check passes (lint + tests)
• Changes align with OWASP principles and project goals
• Existing behavior is not silently broken
• Tests cover new code including failure and abuse paths
• PR description includes: what, why, and how to verify
• Docs updated if the public API or any security default changes

Testing Requirements

OWL enforces security-first testing. All contributions to core modules or adapter hooks must include:

npm run test

Community

• Join OWASP Slack
• Channel: #project-webshield-library
• OWASP Code of Conduct
• CODE_OF_CONDUCT.md

Security Reporting

Do not open public issues for vulnerabilities.

Follow the private reporting process in SECURITY.md.