The main utility that I see in the OWASP Top 10 is as a baseline for the knowledge that we should all be expected to have as developers about web security -- kn

The main utility that I see in the OWASP Top 10 is as a baseline for the knowledge that we should all be expected to have as developers about web security -- knowledge that should be tested at interview, for instance. My main criticism on the other hand is that some of the items on it are too broad in scope. This is especially true of A2 "Broken Authentication and Session Management" which covers three or four vulnerabilities that may be closely related in terms of functionality but are very different technically. Insecure password storage, session fixation and login recovery workflows all have quite different considerations and trade-offs and I'd have thought they would each be worthy of their own separate section.