OWASP Top 10

OWASP Top 10 (2021)

The 10 most critical web application security risks published by OWASP.

The List

Danger

Always validate authorization server-side. Never rely on client-side checks alone.

A01: Broken Access Control

Users can access resources beyond their intended permissions.

# Example: IDOR
GET /api/users/123/profile  ← user 456 can access this

A02: Cryptographic Failures

Using weak encryption algorithms or failing to encrypt sensitive data.

A03: Injection

Caution

Never concatenate user input directly into queries. Always use parameterized queries or prepared statements.

SQL Injection, XSS, Command Injection…

-- SQL Injection example
SELECT * FROM users WHERE id = '1' OR '1'='1'

A04: Insecure Design

Missing security controls in the design phase, not implementation bugs.

A05: Security Misconfiguration

Misconfigured servers, frameworks, or cloud services.

A06: Vulnerable Components

Using libraries/frameworks with known vulnerabilities.

A07: Authentication Failures

Flaws in authentication - brute force, weak passwords, session fixation.

A08: Software & Data Integrity Failures

Failing to verify integrity of software updates and CI/CD pipelines.

A09: Logging & Monitoring Failures

Insufficient logging and monitoring, making attacks undetectable.

A10: SSRF (Server-Side Request Forgery)

Server is tricked into sending requests to internal resources.

Tip

Start by fixing A01 and A03 first — they account for the majority of real-world breaches.

References

• OWASP Official