OWASP Top 10: Web Application Security Reference

What Is OWASP?

The Open Web Application Security Project (OWASP) is a nonprofit foundation that publishes the OWASP Top 10 — a regularly updated list of the most critical web application security risks, widely used as a baseline for security standards.

Current version: OWASP Top 10 2021.

OWASP Top 10 (2021)

A01: Broken Access Control

What: Users can act beyond their intended permissions.

Examples:

• Changing URL from /account/123 to /account/124 (IDOR)
• Accessing admin endpoints without admin role
• Viewing another user's API data by changing a user ID parameter
• Missing function-level authorization on sensitive endpoints

Prevention:

✓ Deny by default — only grant what's explicitly permitted
✓ Log access control failures, alert on repeated failures
✓ Invalidate session tokens on server after logout
✓ Test authorization checks on ALL endpoints, not just UI

A02: Cryptographic Failures

What: Sensitive data exposed due to weak or missing encryption.

Examples:

• Passwords stored as MD5 hashes
• Transmitting credit card numbers over HTTP
• Weak encryption keys or using ECB mode
• Hardcoding secrets in source code

Prevention:

✓ HTTPS everywhere — enforce with HSTS header
✓ Hash passwords with bcrypt, scrypt, or Argon2 (not MD5/SHA1)
✓ Encrypt sensitive data at rest (AES-256)
✓ Never store unnecessary sensitive data
✓ Use secrets management (Vault, AWS Secrets Manager)

A03: Injection

What: Untrusted data sent to an interpreter as part of a command or query.

Types: SQL injection, OS command injection, LDAP injection, XPath, NoSQL, template injection.

Example (SQL injection):

# VULNERABLE
query = f"SELECT * FROM users WHERE email = '{user_input}'"
# Input: ' OR '1'='1 → dumps entire users table

# SAFE — parameterized query
cursor.execute("SELECT * FROM users WHERE email = %s", (user_input,))

Prevention:

✓ Parameterized queries / prepared statements for all DB operations
✓ Use ORM with parameterized queries (SQLAlchemy, Hibernate)
✓ Validate and sanitize all input
✓ Apply least-privilege to database accounts

A04: Insecure Design

What: Missing or ineffective security controls in the design phase — not a coding bug but a design flaw.

Examples:

• No rate limiting on login → brute force
• Password reset via security question (guessable)
• Trusting client-side logic for authorization
• No threat modeling before building

Prevention:

✓ Threat modeling during design phase
✓ Use security design patterns and secure-by-design principles
✓ Reference architectures for high-risk components
✓ Unit and integration tests for security controls

A05: Security Misconfiguration

What: Insecure default configurations left in place.

Examples:

• Default admin credentials unchanged
• Directory listing enabled
• Stack traces shown to users in production
• Unnecessary features/ports enabled
• Missing security headers

Security Headers:

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'; script-src 'self'
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=()

A06: Vulnerable & Outdated Components

What: Using components with known vulnerabilities.

Examples:

• Old versions of jQuery, log4j, OpenSSL, npm packages
• Unpatched OS or server software
• No tracking of component versions

Prevention:

✓ Track all dependencies (Dependabot, OWASP Dependency-Check)
✓ Remove unused dependencies, features, and components
✓ Subscribe to CVE feeds for components you use
✓ Automated dependency update PRs in CI/CD

A07: Identification & Authentication Failures

What: Weaknesses in authentication and session management.

Examples:

• Allowing brute force without lockout or CAPTCHA
• Weak passwords permitted
• Sessions not invalidated after logout
• Session IDs in URLs

Prevention:

✓ Implement MFA for all accounts
✓ Rate limit authentication attempts
✓ Use secure session tokens (sufficient entropy, HttpOnly, Secure, SameSite)
✓ Implement account lockout / CAPTCHA after N failures
✓ Check passwords against breach databases (Have I Been Pwned API)

A08: Software & Data Integrity Failures

What: Making assumptions about software updates and data without verifying integrity.

Examples:

• CI/CD pipeline without signature verification
• Auto-updating dependencies without version pinning
• Deserializing untrusted data
• Insecure NPM packages in supply chain

Prevention:

✓ Verify digital signatures on software packages
✓ Lock dependency versions (package-lock.json, poetry.lock)
✓ Audit CI/CD pipeline for unauthorized changes
✓ Do not deserialize data from untrusted sources without validation

A09: Security Logging & Monitoring Failures

What: Missing or inadequate logging allows breaches to go undetected.

What to log:

✓ Authentication events (success, failure, logout)
✓ Authorization failures (403 errors)
✓ Input validation failures
✓ Session management events
✓ High-value transactions
✓ All admin actions

Log format best practices:

{
  "timestamp": "2026-01-15T10:23:45Z",
  "level": "WARN",
  "event": "auth.failure",
  "user_id": null,
  "ip": "192.168.1.100",
  "endpoint": "/api/admin/users",
  "reason": "invalid_token"
}

A10: Server-Side Request Forgery (SSRF)

What: Attacker causes the server to make requests to unintended locations (including internal networks).

Example:

# Vulnerable endpoint: /api/fetch?url=...
# Attacker sends: /api/fetch?url=http://169.254.169.254/latest/meta-data/
# → Reads AWS EC2 instance metadata (credentials!)

Prevention:

✓ Validate and sanitize all user-supplied URLs
✓ Allowlist DNS names / IPs the service is allowed to contact
✓ Disable HTTP redirects in server-side HTTP clients
✓ Deny requests to private IP ranges (10.x, 192.168.x, 169.254.x)
✓ Don't expose raw error messages (reveals internal topology)

Common Mistakes

• Treating OWASP Top 10 as a complete security checklist — it covers the most common, not all vulnerabilities
• Fixing only the UI layer — injection and access control flaws must be fixed server-side
• Relying on WAF as the only defense — WAFs are a layer, not a substitute for secure code
• Not including security in the design phase — retrofitting security to insecure design is expensive and incomplete
• Ignoring A09 (logging) — most breaches are discovered weeks or months later because monitoring wasn't in place