OWASP Top 10 Explained: The Web Application Risks Every Developer Must Know

The OWASP Top 10 is the best-known awareness document for web application security, published by the Open Worldwide Application Security Project. It is based on data from real applications and surveys of practitioners, and it is the baseline for most web application penetration tests.

OWASP updates the list every few years. This guide uses the widely adopted 2021 edition; check the OWASP website for the latest release. The fundamentals below remain relevant whichever edition you use.

A01: Broken Access Control

Users can act outside their intended permissions: viewing another customer's invoice by changing an ID in the URL, or calling an admin API as a normal user. It is the most common serious finding in my tests. Fix: enforce authorisation on the server for every request, deny by default, and check object ownership, not just whether the user is logged in.

A02: Cryptographic Failures

Sensitive data exposed through missing or weak encryption: plain HTTP, outdated TLS, passwords stored with fast hashes. Fix: TLS everywhere, strong password hashing (such as Argon2, bcrypt or scrypt), encryption at rest for sensitive data and proper key management.

A03: Injection

Untrusted input interpreted as code: SQL injection, command injection, and (in the 2021 edition) cross-site scripting. Fix: parameterised queries, safe APIs, context-aware output encoding and input validation.

A04: Insecure Design

Flaws in the design itself, such as a password reset flow that can be abused or no rate limiting on a coupon system. No amount of perfect code fixes a broken design. Fix: threat modelling during design, secure design patterns and abuse-case testing.

A05: Security Misconfiguration

Default credentials, verbose error messages, directory listing, unnecessary features and missing security headers. Fix: hardened, repeatable configurations, automated configuration checks and removing anything not needed.

A06: Vulnerable and Outdated Components

Libraries, frameworks and plugins with known vulnerabilities. Fix: maintain a software bill of materials, use dependency scanning in CI/CD and patch components as part of normal vulnerability management.

A07: Identification and Authentication Failures

Weak passwords allowed, no protection against credential stuffing, session IDs that do not expire. Fix: MFA, breached-password checks, rate limiting, secure session management and well-tested authentication libraries.

A08: Software and Data Integrity Failures

Trusting updates, plugins or serialised data without verifying integrity, including insecure CI/CD pipelines. Fix: signed updates and artefacts, protected pipelines and avoiding unsafe deserialisation.

A09: Security Logging and Monitoring Failures

Attacks go unnoticed because logins, access failures and high-value transactions are not logged or monitored. Fix: log security events with enough context, protect logs from tampering and send them to a SIEM with alerting.

A10: Server-Side Request Forgery (SSRF)

The application fetches a URL supplied by the user, letting attackers reach internal systems or cloud metadata services. Fix: allow-lists for destinations, blocking internal address ranges, and network segmentation.

Beyond the Top 10

The Top 10 is an awareness document, not a complete testing standard. For thorough testing, use the OWASP Web Security Testing Guide (WSTG) and the Application Security Verification Standard (ASVS). If your application uses AI features, also review the OWASP Top 10 for LLM applications.

Want your web application tested against the OWASP Top 10 and beyond? Contact me.

References and further reading

1. OWASP Top Ten Project
2. OWASP Web Security Testing Guide
3. OWASP Application Security Verification Standard
4. OWASP Cheat Sheet Series