The OWASP Top 10 is the most widely referenced framework for web application security. First published in 2003, it is updated every few years to reflect real-world attack data. The 2021 edition brought three new categories and reshuffled several others. Here is what every developer and security professional needs to know.
What Changed from 2017 to 2021
Three entirely new categories were added: Insecure Design (A04), Software and Data Integrity Failures (A08), and Server-Side Request Forgery (A10). Broken Access Control moved from #5 to #1, reflecting its overwhelming prevalence in real-world breach data.
A01 — Broken Access Control
Broken access control is now the most common vulnerability found in web applications, appearing in 94% of tested applications. It covers any situation where users can act outside their intended permissions.
Common examples: Insecure Direct Object References (IDOR) — changing /api/orders/1001 to /api/orders/1002 to access another user's data. Missing authorization on admin endpoints. CORS misconfiguration allowing cross-origin credential access.
Fix: Enforce authorization checks server-side on every request. Default to deny. Never rely on client-provided role or ID values alone.
A02 — Cryptographic Failures
Previously called "Sensitive Data Exposure," this category was renamed to focus on the root cause rather than the symptom. Cryptographic failures include using outdated TLS versions (1.0, 1.1), weak cipher suites, transmitting sensitive data over HTTP, and storing passwords with reversible or weak hashes like MD5 or SHA-1.
Fix: Enforce TLS 1.2 or higher. Implement HSTS. Use bcrypt, scrypt, or Argon2 for password storage. Never store credit card numbers, session tokens, or SSNs in plaintext.
A03 — Injection
Injection dropped from #1 to #3, but it remains critical. SQL injection, OS command injection, LDAP injection, and Cross-Site Scripting (XSS) all fall into this category. The root cause is always the same: untrusted data is sent to an interpreter without proper separation from commands.
Fix: Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Validate and sanitize all input. Use a Web Application Firewall as a defense-in-depth layer.
A04 — Insecure Design (New)
This is a new category addressing architectural and design-level flaws — problems that cannot be fixed by a patch alone because they are baked into the application's logic. Examples include: a password reset flow that allows OTP brute-forcing because no rate limiting was designed in, or a shopping cart that allows negative quantities for a refund exploit.
Fix: Conduct threat modeling during design. Define security requirements before writing code. Use secure design patterns.
A05 — Security Misconfiguration
The most commonly found issue in manual security audits. This includes default credentials left enabled, verbose error messages exposing stack traces, unnecessary HTTP methods allowed (PUT, DELETE on production), missing security headers, and overly permissive CORS policies.
Fix: Harden all configurations. Disable everything you do not explicitly need. Set security headers on every response. Rotate all default credentials immediately.
A06 — Vulnerable and Outdated Components
Using third-party libraries, frameworks, or CMS plugins with known vulnerabilities is a direct path to compromise. The 2017 Equifax breach — exposing 147 million records — was caused by an unpatched Apache Struts vulnerability.
Fix: Keep a software bill of materials (SBOM). Use tools like npm audit, Dependabot, or Snyk. Monitor CVE feeds for your key dependencies. Remove unused dependencies.
A07 — Identification and Authentication Failures
Previously called "Broken Authentication," this covers weak password policies, missing multi-factor authentication, session tokens in URLs, sessions that are not invalidated after logout, and susceptibility to credential stuffing attacks.
Fix: Use secure, random session IDs. Set HttpOnly, Secure, and SameSite=Strict on session cookies. Invalidate sessions on logout. Implement MFA. Use account lockout or CAPTCHA for login endpoints.
A08 — Software and Data Integrity Failures (New)
This category encompasses insecure deserialization and supply chain integrity issues. A major driver for its addition was the SolarWinds attack, where malicious code was injected into a software build pipeline. For web applications, it also covers loading JavaScript from CDNs without Subresource Integrity (SRI) checks.
Fix: Add integrity and crossorigin attributes to all third-party script and link tags. Verify software signatures in CI/CD pipelines.
A09 — Security Logging and Monitoring Failures
Attackers rely on the fact that most organizations cannot detect a breach until weeks or months later. Missing logs for authentication events, failed access control checks, and input validation errors make incident response nearly impossible.
Fix: Log all authentication events (success and failure). Log access control failures. Centralize logs and set up alerting. Test your detection capabilities regularly.
A10 — Server-Side Request Forgery (New)
SSRF occurs when a web application fetches a remote resource based on a user-supplied URL without proper validation. Attackers can use this to reach internal services, cloud metadata APIs (the classic target is 169.254.169.254), and services behind firewalls.
Fix: Validate and sanitize all user-supplied URLs. Use an allowlist of permitted domains. Block requests to private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x) at the application layer.
How to Audit Your Application
A structured approach to OWASP Top 10 compliance involves both automated scanning and manual review. Automated scanners like Shieldome can quickly identify A02 (TLS issues, missing HTTPS), A05 (security headers, CORS), A07 (insecure cookies), A08 (missing SRI), and more. Manual code review and penetration testing are necessary to catch A01 (IDOR), A03 (logic-based injection), and A04 (insecure design).
The most important thing is to start. Run a baseline scan today, triage the findings by severity, and work through them systematically.