Prerequisites

What OWASP Provides

The Open Worldwide Application Security Project publishes community-driven guidance on application security. Its most referenced output is a periodically revised list of the most significant web application risk categories, derived from observed vulnerability data and practitioner survey.

Broken Access Control

Consistently the most prevalent category. Access control fails when the server does not verify that the authenticated identity is permitted to perform the requested operation on the specific resource.

async function getDocument(request, response) {
    const document = await documentRepository.findById(
        request.params.documentId
    );

    if (!document) {
        return response.status(404).json({ error: "not_found" });
    }

    if (document.tenantId !== request.principal.tenantId) {
        return response.status(404).json({ error: "not_found" });
    }

    const permitted = await authorizationService.canRead(
        request.principal,
        document
    );

    if (!permitted) {
        return response.status(404).json({ error: "not_found" });
    }

    return response.json(toDocumentView(document));
}

Cryptographic Failures

This category covers absent, weak, or misapplied cryptography leading to exposure of data that required protection. The failure is frequently in key handling rather than algorithm choice.

Injection

Injection occurs when untrusted input is interpreted as command or query structure rather than as data. The root cause is constructing an instruction by concatenating strings.

-- Parameterized: the value can never alter query structure
SELECT order_id,
       customer_id,
       total_amount,
       status
FROM orders
WHERE customer_id = :customer_id
  AND status      = :status
  AND tenant_id   = :tenant_id
ORDER BY created_at DESC
LIMIT :page_size;

Insecure Design

A distinct category acknowledging that some applications are implemented flawlessly against a specification that was itself unsafe. No amount of careful coding corrects a missing control.

Security Misconfiguration

Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Cache-Control: no-store

Vulnerable and Outdated Components

Modern applications consist largely of code the team did not write. Transitive dependencies frequently outnumber direct ones by an order of magnitude, and each inherits its own risk.

Identification and Authentication Failures

Software and Data Integrity Failures

This category concerns trusting code, updates, or serialized data without verifying its origin and integrity.

Logging and Monitoring Failures

Insufficient logging does not cause a breach, but it determines whether one is detected in hours or discovered externally months later.

Server-Side Request Forgery

SSRF arises when a server fetches a URL supplied or influenced by a user. The server's network position becomes the attacker's, reaching internal services that are otherwise unreachable.

async function fetchExternalResource(rawUrl, policy) {
    const parsed = new URL(rawUrl);

    if (!policy.allowedProtocols.includes(parsed.protocol)) {
        throw new Error("Protocol not permitted");
    }

    if (!policy.allowedHosts.includes(parsed.hostname)) {
        throw new Error("Host not on allow-list");
    }

    const addresses = await resolveHostname(parsed.hostname);

    for (const address of addresses) {
        if (isPrivateOrReservedAddress(address)) {
            throw new Error("Resolved to a restricted address");
        }
    }

    return await httpClient.get(parsed.toString(), {
        timeoutMs: policy.timeoutMs,
        maxRedirects: 0,
        maxResponseBytes: policy.maxResponseBytes,
        pinnedAddress: addresses[0]
    });
}

Mapping Risks to Controls

Cross-Cutting Principles

Verification Approaches

describe("tenant isolation", function () {
    it("does not expose another tenant's document", async function () {
        const foreign = await createDocument({ tenantId: "tenant-a" });

        const response = await requestAs(
            { tenantId: "tenant-b", role: "administrator" },
            `/api/documents/${foreign.id}`
        );

        expect(response.statusCode).toBe(404);
    });

    it("rejects client-supplied role escalation", async function () {
        const response = await patchAs(
            { userId: "user-1", role: "viewer" },
            "/api/users/user-1",
            { displayName: "Updated", role: "administrator" }
        );

        const stored = await userRepository.findById("user-1");

        expect(stored.role).toBe("viewer");
        expect(response.statusCode).not.toBe(500);
    });
});

Common Design Mistakes

System Design Interview Discussion

Review Checklist

Knowledge Check

Summary

The OWASP risk categories describe recurring classes of web application weakness observed across the industry. They are awareness material for structuring review and prioritizing effort, not a standard that confers security when satisfied.

Broken access control remains the most prevalent, because it must be enforced on every path and cannot be verified automatically without knowledge of intended permissions. Injection persists wherever instructions are built by concatenation, and cryptographic failures usually trace to key handling rather than algorithm selection.

Insecure design acknowledges that some applications implement an unsafe specification correctly. Misconfiguration, outdated components, and integrity failures extend the concern beyond application code into configuration, dependencies, and the build pipeline.

Logging failures determine whether a compromise is detected in hours or months, and server-side request forgery turns the server's network position into an attacker's. Across all of them, the durable principles are the same: distrust the client, deny by default, fail closed, layer controls, centralize enforcement, and minimize what exists to be attacked.