Application Security
OWASP Top 10 (2021)
1. Broken Access Control
Risk: Users accessing unauthorized resources.
Prevention:
- Deny by default
- Implement RBAC/ABAC
- Validate permissions server-side
- Log access failures
2. Cryptographic Failures
Risk: Sensitive data exposure.
Prevention:
- Encrypt data at rest and in transit
- Use strong algorithms (AES-256, RSA-2048+)
- Never store passwords in plaintext
- Use secure key management
3. Injection
Risk: Malicious input executed as code.
Prevention:
// BAD - SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;
// GOOD - Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
db.query(query, [userId]);4. Insecure Design
Risk: Missing security controls by design.
Prevention:
- Threat modeling
- Security requirements
- Defense in depth
5. Security Misconfiguration
Risk: Default or weak configuration.
Prevention:
- Disable unnecessary features
- Remove default credentials
- Keep software updated
- Harden server configuration
6. Vulnerable Components
Risk: Using libraries with known vulnerabilities.
Prevention:
- Regular dependency audits
- Keep dependencies updated
- Monitor CVE databases
7. Authentication Failures
Risk: Weak or broken authentication.
Prevention:
- Multi-factor authentication
- Strong password policies
- Secure session management
- Rate limiting on login
8. Software & Data Integrity
Risk: Untrusted sources for updates.
Prevention:
- Verify code signatures
- Use SRI for CDN resources
- Secure CI/CD pipeline
9. Logging & Monitoring Failures
Risk: Attacks go undetected.
Prevention:
- Log security events
- Monitor for anomalies
- Alert on suspicious activity
10. Server-Side Request Forgery
Risk: Server makes requests to unintended destinations.
Prevention:
- Validate URLs
- Use allowlists
- Block internal IPs