All articles
Security EngineeringApplication Security
Browse Knowledge Base

OWASP Top 10 Web Vulnerabilities - Security Guide

12 min read

Learn OWASP Top 10 web application vulnerabilities with mitigations and security patterns. Covers injection, XSS, broken access control, SSRF, and more.

The OWASP Top 10 represents the most critical web application security risks, serving as an essential awareness document for developers and security professionals. Rather than functioning as a complete threat model, this vulnerability classification provides a teaching framework that security engineers convert into practical guardrails within frameworks, CI/CD pipelines, and platform architectures.

When implemented correctly, security guardrails make common mistakes unrepresentable in code. The goal is to make the secure path the easy path through framework selection, automated testing, and defense-in-depth.

Effective web application security requires a layered approach combining secure-by-default frameworks, automated security gates through application security testing, and defense-in-depth with runtime protections.

Secure-by-Default Patterns

Building secure web applications begins with selecting frameworks and architectures that prevent vulnerabilities by design. Rather than relying on developers to remember security controls, secure-by-default patterns make the safe path the easiest path.

Framework Selection

Secure-by-default frameworks prevent entire vulnerability classes through built-in security controls. Framework selection represents the most impactful security decision an engineering team makes, as the choice determines which vulnerabilities are possible within the codebase.

Modern frameworks should provide auto-escaping templating engines that prevent XSS by default, eliminating the need for manual escaping which is inherently error-prone. Built-in CSRF token generation and validation should handle cross-site request forgery protection automatically, without requiring developer intervention. Typed query builders and ORMs prevent SQL injection by separating code from data, making parameterized queries the default behaviour. Frameworks should also support strict Content Security Policy (CSP) headers that limit XSS impact even when other protections fail.

CI/CD Security Gates

Security rules encoded in DevSecOps pipelines ensure consistent enforcement across all code changes. Automation removes the human error factor from security verification, making security checks mandatory rather than optional.

Effective pipeline security includes multiple layers of verification:

  • Linters catch common security mistakes at commit time, providing immediate feedback
  • SAST (Static Application Security Testing) analyses source code to find vulnerabilities before builds complete
  • DAST (Dynamic Application Security Testing) tests running applications to discover runtime vulnerabilities before deployment
  • Dependency allow-lists prevent introduction of malicious or unapproved packages
  • Secret scanners detect and block credential leaks before they reach version control

Runtime Protections

Runtime protections provide defense-in-depth by detecting and blocking attacks that bypass other controls. Web Application Firewalls (WAF) block common attack patterns at the network edge, providing a layer of protection independent of application code. Runtime Application Self-Protection (RASP) operates within the application itself, providing context-aware protection that understands application logic and can detect sophisticated attacks that WAFs might miss.

Data Layer Security

Least privilege at the data layer limits blast radius when breaches occur. Database users should possess only the minimum permissions required for their function, ensuring that compromised credentials cannot access unauthorized data. Every data request should undergo authorisation verification, with no requests bypassing access controls. In multi-tenant applications, strong tenant isolation enforced at the database level prevents cross-tenant data access.

OWASP Top 10 Vulnerability Classes

The following sections detail each vulnerability class from the 2021 OWASP Top 10, including descriptions, mitigations, and testing approaches that security engineers should implement.

A01:2021 - Broken Access Control

Broken access control vulnerabilities allow users to access resources or perform actions beyond their authorised permissions. According to OWASP, access control failures represent the most common vulnerability class, having moved from fifth position in 2017 to the top position in 2021.

Common manifestations include Insecure Direct Object References (IDOR) where applications expose internal object identifiers without proper authorisation checks, enabling attackers to access other users' data by manipulating these identifiers. Missing function-level access control allows unauthorized function execution when applications fail to verify permissions at the function level.

Mitigations

Effective access control requires server-side authorisation enforcement on every request, as client-side checks provide no real security. Authorisation logic should never rely on client-supplied signals including hidden form fields, cookies, or headers, since attackers can manipulate all client-controlled data. Centralized authorisation using policy engines like Open Policy Agent (OPA) or Cedar with middleware ensures consistent enforcement across all endpoints. A deny-by-default posture requires explicit grants for all access, preventing accidental exposure when new resources are added.

Testing

Security testing for access control includes graph exploration that fuzzes routes and resource identifiers to discover IDOR vulnerabilities. Negative tests verify that authorisation properly fails when credentials are missing or insufficient. Automated IDOR scanners scale testing across large applications to find access control gaps systematically.

A02:2021 - Cryptographic Failures

Cryptographic failures expose sensitive data through weak, misconfigured, or missing encryption. This vulnerability class encompasses failures in protecting data both in transit and at rest, and represents a leading cause of data breaches.

Mitigations

All network communications should use TLS 1.2 or higher, as older versions contain known vulnerabilities. HTTP Strict Transport Security (HSTS) headers force HTTPS connections and prevent protocol downgrade attacks. Certificate pinning validates server certificates in high-security contexts, though requires careful rotation planning to avoid service disruption.

For encryption, use modern Authenticated Encryption with Associated Data (AEAD) algorithms including AES-GCM or ChaCha20-Poly1305 that provide both confidentiality and integrity guarantees. Implement regular key rotation to limit exposure from potential key compromise, and use a Key Management Service (KMS) to back root keys with hardware security modules. Never implement custom cryptographic algorithms—use established, audited libraries instead. All tokens and artifacts should be signed to prevent tampering, and secrets should be protected via brokered access through secrets management systems rather than embedded in code or configuration.

A03:2021 - Injection

Injection vulnerabilities allow attackers to execute unintended commands or queries by inserting malicious data into application inputs. This class includes SQL injection, NoSQL injection, LDAP injection, OS command injection, and other interpreter-based attacks.

Mitigations

Parameterized queries separate code from data, making injection attacks impossible regardless of input content. Query builders and ORMs provide safe query construction by preventing string concatenation with user input. Stored procedures with strict typing add an additional layer of input validation.

Dangerous shells and unescaped string interpolation should be rejected outright, as shell injection represents one of the most critical vulnerability types. Input validation should verify type, length, format, and range constraints before processing any user input. Input canonicalization prevents encoding-based bypass attacks by normalizing input to a standard form before validation. For templating engines and report builders that must execute dynamic content, sandboxed execution environments contain potential damage.

A04:2021 - Insecure Design

Insecure design represents a category of security weaknesses stemming from missing or ineffective security controls at the design phase. Unlike implementation bugs that can be fixed with code changes, fundamental design flaws require architectural rework to address properly.

Mitigations

Threat modeling should occur early in the design phase before significant implementation begins. Building misuse and abuse cases into requirements documentation helps identify design weaknesses before they become embedded in architecture. Security-relevant design decisions include rate limiting to prevent abuse, quotas to limit resource consumption and prevent denial of service, idempotency to enable safe retries without unintended side effects, and replay protection to prevent captured requests from being reused maliciously. Limited capability tokens with specific scopes are preferable to omnipotent session cookies, as capability tokens limit blast radius when compromised.

A05:2021 - Security Misconfiguration

Security misconfiguration encompasses insecure default settings, incomplete configurations, open cloud storage, misconfigured HTTP headers, verbose error messages containing sensitive information, and any configuration weakness that could be exploited.

Mitigations

Immutable infrastructure prevents configuration drift by replacing instances rather than modifying them. Configuration as code enables version control, peer review, and automated deployment of security settings. CIS Benchmarks provide secure configuration standards that should be enforced through automated compliance scanning. Default-deny policies for both network and application access prevent unauthorized access by requiring explicit allow rules. Secrets should never be stored in environment variables by default due to their tendency to leak through logs and error messages. Telemetry on policy changes enables detection of unauthorized modifications, while drift detection identifies configuration changes that may indicate compromise.

A06:2021 - Vulnerable and Outdated Components

Modern applications rely heavily on third-party libraries, frameworks, and dependencies. Vulnerable and outdated components represent a significant attack surface, as known vulnerabilities in popular packages are widely exploited.

Mitigations

Software Composition Analysis (SCA) tools continuously scan dependencies to identify known vulnerabilities, and should be integrated into CI/CD pipelines to block builds with critical issues. Emergency patch playbooks document rapid response procedures for critical vulnerability disclosures. Automated dependency update tools like Renovate or Dependabot create pull requests for updates, reducing the manual effort required to stay current. A Software Bill of Materials (SBOM) documents all dependencies for vulnerability tracking and compliance. Avoid deprecated runtimes that no longer receive security updates, and only backport security fixes when vendor support exists.

Transitive dependencies should be pinned to specific versions to prevent unexpected updates that could introduce vulnerabilities. Allow-listed package registries prevent introduction of malicious packages from untrusted sources. Signature verification on all packages validates integrity and prevents tampering during distribution.

A07:2021 - Identification and Authentication Failures

Identification and authentication failures encompass weaknesses that allow attackers to compromise user accounts through credential attacks, session hijacking, or authentication bypass. These vulnerabilities enable account takeover with potentially severe consequences.

Mitigations

Centralized authentication using standards like OIDC or SAML ensures consistent implementation across all applications and reduces the surface area for authentication bugs. Multi-factor authentication (MFA) should be required for all users, as it dramatically reduces the impact of credential compromise. Where feasible, passwordless authentication using hardware tokens or passkeys eliminates password-related vulnerabilities entirely.

For password-based systems, use secure password hashing algorithms like argon2id or bcrypt with appropriate work factors—weak hashing enables offline password cracking. Account lockouts prevent brute force attacks but should be temporary to avoid denial of service. Step-up authentication requiring re-authentication for sensitive operations limits the impact of session compromise. Credential stuffing attacks using breached password databases should be mitigated through rate limiting, anomaly detection, and checking passwords against known breach databases.

A08:2021 - Software and Data Integrity Failures

Software and data integrity failures occur when applications fail to protect code and data against unauthorised modification. This vulnerability class enables supply chain attacks where malicious code is injected into trusted components.

Mitigations

Signed releases with verified signatures ensure package authenticity and prevent distribution of tampered artifacts. Verified provenance through frameworks like SLSA (Supply-chain Levels for Software Artifacts) validates the entire build process. Protected branches in version control prevent unauthorised code changes and enforce review requirements. Mandatory code reviews provide human validation of all changes. Pipeline protection—including isolated runners, strict secret hygiene, and ephemeral credentials—prevents compromise of the build system itself. Integrity checks should validate configuration files, templates, and artifacts at runtime to detect tampering.

A09:2021 - Security Logging and Monitoring Failures

Insufficient logging and monitoring prevents detection of active attacks and hinders incident response. Without comprehensive security telemetry, organizations operate with dangerous blind spots.

Mitigations

Security events should be logged comprehensively, including authentication attempts, access control failures, input validation failures, and other security-relevant events. Logs should be centralized in a protected system where they cannot be tampered with by attackers who compromise application servers. Alerting rules should trigger on security events requiring immediate attention. Log retention periods should support incident investigation requirements and comply with regulatory mandates.

A10:2021 - Server-Side Request Forgery (SSRF)

Server-Side Request Forgery vulnerabilities allow attackers to induce the server to make requests to arbitrary destinations. SSRF is particularly dangerous in cloud environments where it can access internal services and cloud metadata endpoints containing credentials.

Mitigations

Cloud metadata endpoints should be blocked or accessed only through IMDSv2 (Instance Metadata Service v2) which requires session tokens and prevents simple SSRF attacks.

Egress proxies with allow-lists control outbound requests to prevent access to unauthorised destinations. Service isolation through network segmentation limits SSRF impact by containing what attackers can reach. Mutual TLS (mTLS) authenticates all service-to-service communication, preventing unauthorised access even if SSRF reaches internal services. Any application functionality that fetches URLs based on user input should be treated as high risk and carefully sandboxed. DNS resolution should be restricted to prevent DNS rebinding attacks that can circumvent IP-based allow-lists.

Additional Critical Vulnerabilities

Beyond the OWASP Top 10, several additional vulnerability classes require attention from security engineers building web applications.

Cross-Site Scripting (XSS)

Cross-Site Scripting allows attackers to inject malicious scripts into web pages viewed by other users. XSS enables session hijacking, credential theft, and malicious actions performed as the victim user. While XSS prevention is addressed through secure frameworks, it warrants specific attention.

Auto-escaping templating engines prevent the vast majority of XSS vulnerabilities by encoding output by default. A strict Content Security Policy (CSP) limits XSS impact even when injection occurs by preventing inline script execution and restricting script sources. Input validation provides defense-in-depth by rejecting input that appears to contain script content.

Deserialization Vulnerabilities

Unsafe deserialization can enable remote code execution when applications deserialize untrusted data into objects. This vulnerability class is particularly dangerous as exploitation often leads to complete system compromise.

Avoid unsafe deserializers that allow arbitrary object instantiation. Prefer JSON with strict schemas over binary serialization formats which tend to have more dangerous deserializers. Implement type verification and whitelists to restrict which classes can be instantiated during deserialization. Disable polymorphic deserialization features that enable gadget chain attacks. Use payload versioning to detect and reject tampered serialized data.

Testing Strategy

A comprehensive testing strategy validates that security controls function correctly across unit, integration, and runtime phases.

Unit Testing

Security-focused unit tests should verify authorisation logic on every controller and service method. These tests catch logic errors early in development when fixes are inexpensive. Negative tests are essential—explicitly verify that unauthorized requests fail with appropriate errors rather than just testing the happy path.

Integration Testing

Dynamic Application Security Testing (DAST) with authenticated scans tests the running application for vulnerabilities that only manifest at runtime. Fuzzing techniques applied to routing logic and resource identifiers discover edge cases and unexpected behaviors that may indicate security issues.

Runtime Testing

Canary rules in Web Application Firewalls enable safe rollout of new protection rules by monitoring for false positives before enforcement. Shadow traffic analysis powers anomaly detection systems that can identify novel attacks without signatures.

Conclusion

The OWASP Top 10 provides a critical foundation for understanding web application security, but effective security requires translating these vulnerability classes into engineering guardrails embedded in frameworks, pipelines, and platforms. Security engineers who invest in secure-by-default patterns, automated security gates, and defense-in-depth protections prevent entire vulnerability classes rather than chasing individual bugs.

Success requires thoughtful framework selection with built-in security controls, CI/CD gates incorporating both SAST and DAST, comprehensive security testing at all phases, and runtime protection through WAF and RASP technologies. Organizations that systematically address these areas build applications where security is inherent rather than bolted on.

Related Articles

References

Previous

OT/ICS Security - Industrial Control Systems Protection

Next

Performance Engineering for Security Tools: Latency, Throughput & Capacity Planning