Introduction to the OWASP Top 10

The OWASP Top 10 is the most widely referenced web application security classification. Updated every three to four years, it represents the consensus view of the most critical security risks to web applications. The 2021 edition introduced significant changes from the 2017 edition, reflecting the evolving threat landscape.

What Changed in 2021

The 2021 edition introduced four new categories:

• A04 Insecure Design — Replaces A06 (Security Misconfiguration moved to A05). Focuses on risks inherent in the design, not just implementation.
• A08 Software and Data Integrity Failures — New category covering CI/CD pipeline attacks, insecure deserialization, and software supply chain risks.
• A10 SSRF — Server-Side Request Forgery was promoted from a community survey entry to the Top 10.
• XSS was folded into A03 Injection, reflecting the understanding that XSS is a form of injection.

How to Use This Guide

This product provides a thorough reference for each category. For each one you get:

• A plain-English explanation of the vulnerability
• Concrete examples of vulnerable and fixed code
• Test procedures for manual and automated verification
• A remediation checklist you can copy into your issue tracker
• References to authoritative secure-coding resources

The Categories at a Glance

A01 Broken Access Control — Users can access resources they shouldn't

A02 Cryptographic Failures — Weak or missing encryption for sensitive data

A03 Injection — Untrusted data executed as code or queries

A04 Insecure Design — Architecture-level security flaws

A05 Security Misconfiguration — Defaults, debug modes, unnecessary features

A06 Vulnerable Components — Outdated libraries with known vulnerabilities

A07 Auth Failures — Weak login, session management, or credential recovery

A08 Integrity Failures — Tampered software, deserialization attacks, poisoned CI/CD

A09 Logging and Monitoring Failures — Inability to detect and respond to attacks

A10 SSRF — Server makes unintended network requests from attacker-controlled input

Access Control & Cryptographic Failures

A01: Broken Access Control

Access control enforces what authenticated users are allowed to do. Broken access control is consistently the most common and most severe web application vulnerability.

Common flaws:

• Insecure Direct Object References (IDOR) — Users manipulate IDs to access other users' data
• Missing function-level access control — Admin endpoints accessible to regular users
• Mass assignment — Users add unexpected fields to request bodies to modify protected properties
• Path traversal — Users access files outside the intended directory

Fix: enforce deny-by-default. Every endpoint should explicitly declare who can access it. Default to denial unless the user has a verified role or permission that grants access.

A02: Cryptographic Failures

This category covers failures related to cryptography — or the lack of it. The most common issues are not about broken encryption algorithms but about not using encryption at all, or using it incorrectly.

Common flaws:

• Transmitting sensitive data over unencrypted connections (HTTP, not HTTPS)
• Storing passwords with outdated hashes (MD5, SHA-1, unsalted)
• Using weak or hardcoded cryptographic keys
• Not enforcing TLS for all communications

Fix: use modern, vetted cryptography. Passwords should be hashed with bcrypt, scrypt, or Argon2 — never with a general-purpose hash function. TLS 1.2+ should be required for all connections. Encryption keys should be managed through a proper secrets management system.