Getting Started

OWL ships as two packages:

Package	Purpose
@owasp-webshield/core	Framework-agnostic core — every A01–A10 module, usable from plain Node.js or any framework.
@owasp-webshield/react	React adapter — providers, hooks, and guard components built on top of the core.

Installation

npm

npm install @owasp-webshield/core

pnpm

pnpm add @owasp-webshield/core

yarn

yarn add @owasp-webshield/core

If you're building a React app, also install the adapter:

npm install @owasp-webshield/react

Browser bundling

@owasp-webshield/core's crypto and SSRF modules (CryptoManager, SSRFGuard, SafeFetcher) use Node's built-in node:crypto and node:dns/promises. Bundling them into a browser app with Vite/webpack requires polyfilling those built-ins, or avoiding those specific modules client-side. See the FAQ for details.

Quick Start

A minimal access-control example using TokenManager, AuthManager, RBACManager, and ACLManager together:

import {
  TokenManager,
  AuthManager,
  RBACManager,
  ACLManager,
  PermissionChecker
} from "@owasp-webshield/core";

const tokenManager = new TokenManager();
tokenManager.setTokens({ accessToken: "jwt", expiresAt: Date.now() + 3600000 });

const authManager = new AuthManager({ tokenManager });
authManager.setSession({ userId: "u1", roles: ["admin"] });

const rbac = new RBACManager();
rbac.defineRole("admin", ["read:invoice", "update:invoice"]);

const acl = new ACLManager();
acl.setPolicy("invoice", "delete", "deny");

const permissions = new PermissionChecker({ rbacManager: rbac, aclManager: acl });
console.log(permissions.check({ role: "admin", action: "read", resource: "invoice" }));

From here:

• Building a React app? Continue to React Adapter Setup.
• Want the full picture of which module covers which OWASP category? See the Module Map.
• Looking for a specific class or hook? Jump straight into the API Reference.

Runnable examples

The repository ships several runnable examples you can clone and run directly:

Example	Description
OWL Enabled Node Secrets App	Team credential vault on plain @owasp-webshield/core, covering every OWASP category (A01–A10)
OWL Enabled React Todo App	Full-featured Todo app on the React adapter, covering every OWASP category (A01–A10) in one product