CodeParkThe OWASP Top 10 2021 list, with one backend control for each:
- A01 Broken Access Control: check that the user owns the resource on every request.
- A02 Cryptographic Failures: use TLS everywhere, and hash passwords with Argon2id.
- A03 Injection (including XSS): use parameterised queries and encode output.
- A04 Insecure Design: do threat modelling, which means listing how an attacker could misuse a feature before you build it.
- A05 Security Misconfiguration: harden configs and set security headers.
- A06 Vulnerable and Outdated Components: scan dependencies and patch them.
- A07 Identification and Authentication Failures: use MFA (multi-factor authentication) and rate limiting.
- A08 Software and Data Integrity Failures: sign build artefacts and deserialize data safely.
- A09 Security Logging and Monitoring Failures: keep audit logs and set up alerts.
- A10 Server-Side Request Forgery (SSRF): use a URL allowlist for outbound requests that the server makes.
The Top 10 is an awareness document, not a full standard. For a checklist to verify an app, use OWASP ASVS (Application Security Verification Standard). For APIs, OWASP has a separate API Security Top 10.
- The answer names all ten 2021 categories in order.
- A01 Broken Access Control is first.
- Each category has a concrete backend control.
- The Top 10 is an awareness document. Use ASVS to verify an app.
- APIs have a separate API Security Top 10.
Read more