Application Security
OWASP Top 10 (2021)
1. Broken Access Control
Risk: Users accessing unauthorized resources.
Prevention:
- Deny by default
- Implement RBAC/ABAC
- Validate permissions server-side
- Log access failures
2. Cryptographic Failures
Risk: Sensitive data exposure.
Prevention:
- Encrypt data at rest and in transit
- Use strong algorithms (AES-256, RSA-2048+)
- Never store passwords in plaintext
- Use secure key management
3. Injection
Risk: Malicious input executed as code.
Prevention:
// ❌ BAD - SQL injection vulnerability
@GetMapping("/users/{id}")
public User getUser(@PathVariable String id) {
String query = "SELECT * FROM users WHERE id = " + id;
return jdbcTemplate.queryForObject(query, User.class);
}
// ✅ GOOD - Use JPA/Spring Data (parameterized by default)
@Repository
public interface UserRepository extends JpaRepository<User, Long> {
Optional<User> findById(Long id);
}
// ✅ GOOD - JPQL with named parameters
@Query("SELECT u FROM User u WHERE u.email = :email AND u.status = :status")
Optional<User> findByEmailAndStatus(
@Param("email") String email,
@Param("status") UserStatus status
);
// ❌ BAD - Command injection
Runtime.getRuntime().exec("ls " + userInput);
// ✅ GOOD - Use ProcessBuilder with separate arguments
ProcessBuilder pb = new ProcessBuilder("ls", userInput);
Process p = pb.start();4. Insecure Design
Risk: Missing security controls by design.
Prevention:
- Threat modeling
- Security requirements
- Defense in depth
5. Security Misconfiguration
Risk: Default or weak configuration.
Prevention:
- Disable unnecessary features
- Remove default credentials
- Keep software updated
- Harden server configuration
6. Vulnerable Components
Risk: Using libraries with known vulnerabilities.
Prevention:
- Regular dependency audits
- Keep dependencies updated
- Monitor CVE databases
7. Authentication Failures
Risk: Weak or broken authentication.
Prevention:
- Multi-factor authentication
- Strong password policies
- Secure session management
- Rate limiting on login
8. Software & Data Integrity
Risk: Untrusted sources for updates.
Prevention:
- Verify code signatures
- Use SRI for CDN resources
- Secure CI/CD pipeline
9. Logging & Monitoring Failures
Risk: Attacks go undetected.
Prevention:
- Log security events
- Monitor for anomalies
- Alert on suspicious activity
10. Server-Side Request Forgery
Risk: Server makes requests to unintended destinations.
Prevention:
- Validate URLs
- Use allowlists
- Block internal IPs