OWASP Top 10 — Cheat Sheet

Tags: security, owasp, web-security, appsec, vulnerabilities, backend

Level: intermediate

TL;DR: Standard reference framework for critical web application security risks and best practices to prevent exploits.

Key concepts

A01:2021 Broken Access Control: failures in enforcing user permissions, IDOR, privilege escalation, or unauthorized data exposure.

A02:2021 Cryptographic Failures: transmission of sensitive data in cleartext or use of weak, deprecated encryption algorithms.

A03:2021 Injection: untrusted data interpreted as commands, including SQL, NoSQL, OS command injection, and cross-site scripting (XSS).

A04:2021 Insecure Design: architecture-level flaws requiring threat modeling and secure design patterns before code implementation.

A05:2021 Security Misconfiguration: unhardened default accounts, verbose error messages, open cloud storage, and unneeded enabled features.

A06:2021 Vulnerable and Outdated Components: running unpatched third-party libraries, dependencies, and OS packages with known CVEs.

A07:2021 Identification and Authentication Failures: weak credential handling, brute-force vulnerability, and missing multi-factor authentication.

A08:2021 Software and Data Integrity Failures: untrusted CI/CD pipelines, insecure deserialization, and auto-updates without signature verification.

A09:2021 Security Logging and Monitoring Failures: lack of audit trails, unlogged breaches, and absent alerting allowing persistent threats.

A10:2021 Server-Side Request Forgery (SSRF): server coerced into fetching remote resources, exposing cloud metadata or internal microservices.

Typical questions and ready answers

Q: How do you prevent Broken Access Control in a REST API?R: Enforce authorization checks on the server for every endpoint and record ID, verify tenant ownership, and deny access by default.

Q: What is the most effective defense against SQL Injection?R: Always use parameterized queries or ORM prepared statements, never concatenate raw user input, and enforce input validation with least privilege.

Q: How do you handle SSRF risks when fetching external URLs?R: Validate URLs against strict DNS whitelists, block RFC 1918 private ranges, disable HTTP redirects, and restrict outgoing firewall traffic.

Q: What is the difference between Insecure Design and Security Misconfiguration?R: Insecure design is a conceptual flaw in business logic before coding, whereas misconfiguration is an implementation or deployment oversight.

Pitfalls and common mistakes

Relying on client-side validation or UI element hiding to enforce access controls.

Storing passwords with fast hashing algorithms like MD5 or SHA-256 instead of Argon2, bcrypt, or scrypt.

Leaking stack traces, system paths, or environment variables in production API error responses.

Whitelisting domains without validating subdomains or preventing DNS rebinding in outgoing HTTP clients.

Forgetting to scan dependencies in CI/CD pipelines with automated vulnerability tooling like npm audit or Snyk.

Trusting user-supplied JWT algorithms and failing to verify signatures with an asymmetric public key.

Snippets and commandsTypeScript

// Parameterized query preventing SQL injection
import { query } from './db';

export async function getUserProfile(userId: string) {
  const sql = 'SELECT id, email, role FROM users WHERE id = $1';
  const { rows } = await query(sql, [userId]);
  return rows[0] ?? null;
}

Bash

# Scan npm dependencies for known vulnerabilities
npm audit --audit-level=high

# Run dependency-check against project manifests
npx snyk test

To review

[ ] Review differences between OWASP Top 10 2017 and 2021 categories

[ ] Verify CSRF token handling and SameSite cookie attributes across all authenticated endpoints

[ ] Implement rate limiting on sensitive authentication routes (/login, /reset-password)

[ ] Block server outbound access to cloud metadata IP 169.254.169.254

References

OWASP Top 10 2021 Official Documentation: https://owasp.org/Top10/

OWASP Cheat Sheet Series: https://cheatsheetseries.owasp.org/