The OWASP Top 10 (2021) Architecture Matrix
The OWASP Top 10 is the globally recognized standard awareness document for web application security risks.
OWASP Top 10 2021 vs. 2017 Taxonomy Evolution & Remediation Matrix
| 2021 Rank & Category | 2017 Rank | Root Cause & Key Risk | Core Architectural Defense |
|---|---|---|---|
| A01:2021 Broken Access Control | Moved from #5 | Enforcing permissions in client UI rather than backend queries | Enforce tenancy checks on 100% of database queries (BOLA defense) |
| A02:2021 Cryptographic Failures | Moved from #3 (Sensitive Data Exposure) | Weak cipher suites, plaintext storage, missing TLS 1.3 | AES-256-GCM encryption at rest; Argon2id password hashing |
| A03:2021 Injection | Fell from #1 | Concatenating user data into SQL, LDAP, or shell commands | Parameterized prepared statements; allowlist input validation |
| A04:2021 Insecure Design | NEW Category | Architectural security flaws prior to code implementation | Threat modeling; secure design patterns; reference architectures |
| A05:2021 Security Misconfiguration | Moved from #6 | Default passwords, verbose debug stack traces, open S3 buckets | Automated configuration hardening; disabling debug flags in prod |
| A06:2021 Vulnerable & Outdated Components | Moved from #9 | Using unpatched npm/PyPI dependencies with published CVEs | Automated SCA scanning in CI/CD; automated Dependabot updates |
| A07:2021 Identification & Auth Failures | Fell from #2 | Credential stuffing, missing MFA, predictable sessions | Argon2id hashing; FIDO2 passkeys; __Host- session cookies |
| A08:2021 Software & Data Integrity Failures | NEW Category | Insecure deserialization, untrusted CI/CD pipelines, Auto-updates | Subresource Integrity (SRI) hashes; signed deployment artifacts |
| A09:2021 Security Logging & Monitoring Failures | Moved from #10 | Breaches go undetected for months due to missing audit trails | Immutable CloudTrail logging; real-time anomaly alerting in SIEM |
| A10:2021 Server-Side Request Forgery (SSRF) | NEW Category | Server fetches attacker-supplied URLs without network boundaries | Egress firewalls; blocking cloud metadata IP (169.254.169.254) |
The 2021 OWASP Top 10 reflects significant evolution in how modern web applications are built, deployed, and attacked:
| Rank | Category Name | Primary CWEs | Core Risk Description |
|---|---|---|---|
| A01 | Broken Access Control | CWE-200, CWE-284, CWE-639 | Users acting outside intended permissions (IDOR, privilege escalation) |
| A02 | Cryptographic Failures | CWE-259, CWE-327, CWE-331 | Weak encryption, cleartext transmission, deprecated algorithms |
| A03 | Injection | CWE-79, CWE-89, CWE-77 | SQLi, XSS, Command Injection altering parser execution trees |
| A04 | Insecure Design | CWE-209, CWE-256, CWE-501 | Flaws in architecture, missing threat modeling, unvalidated logic |
| A05 | Security Misconfiguration | CWE-16, CWE-611, CWE-1004 | Default credentials, unneeded features, verbose stack traces |
| A06 | Vulnerable & Outdated Components | CWE-1104 | Unpatched CVEs in open source libraries and dependencies |
| A07 | Identification & Authentication Failures | CWE-287, CWE-384 | Session fixation, credential stuffing, missing brute force controls |
| A08 | Software & Data Integrity Failures | CWE-494, CWE-502 | Insecure deserialization, unsigned CI/CD pipelines, auto-updates |
| A09 | Security Logging & Monitoring Failures | CWE-778, CWE-117 | Insufficient audit logging, delayed breach detection, unmonitored alerts |
| A10 | Server-Side Request Forgery (SSRF) | CWE-918 | Server induced to make unintended requests to internal networks |
A01:2021 - Broken Access Control (Rank #1)
Rising from rank #5 in 2017 to the #1 most prevalent security risk, Broken Access Control occurs when applications fail to properly enforce restrictions on what authenticated users are allowed to do.
Common Variants
- Insecure Direct Object References (IDOR): An attacker alters a record ID in an API request (
GET /api/documents/1094to1095) to access another tenant's confidential files. - Vertical Privilege Escalation: A standard user accesses administrative routes (
POST /admin/delete-user) because the endpoint only verifies login status, not administrative role. - CORS Misconfiguration: Permitting
Access-Control-Allow-Origin: *withAccess-Control-Allow-Credentials: true.
Remediation Pattern
Deny access by default. Validate ownership on every single database lookup:
// SAFE: Enforce multi-tenant ownership in the database query itself
export async function getInvoiceSafe(userId: string, invoiceId: string) {
const invoice = await prisma.invoice.findFirst({
where: {
id: invoiceId,
userId: userId, // CRITICAL: Restricts lookup strictly to the authenticated user's records
},
});
if (!invoice) {
throw new NotFoundError('Invoice not found');
}
return invoice;
}A02:2021 - Cryptographic Failures
Formerly known as 'Sensitive Data Exposure', this category focuses on cryptographic root causes that lead to data compromise:
- Transmitting data in cleartext (HTTP, FTP, SMTP)
- Using broken or deprecated cryptographic algorithms (MD5, SHA-1, RC4, DES)
- Hardcoding encryption keys in source code repositories
- Using default or weak password hashing functions (e.g., standard SHA-256 instead of Argon2id or bcrypt)
Remediation
- Enforce TLS 1.3 across all endpoints with HSTS.
- Store passwords using Argon2id or bcrypt with high work factors.
- Encrypt sensitive data at rest using AES-256-GCM with managed KMS key rotation.
A03:2021 - Injection Flaws
Injection occurs when untrusted input is interpreted as part of a command or query. This includes SQL injection, Cross-Site Scripting (XSS), OS Command Injection, LDAP injection, and Server-Side Template Injection (SSTI).
Remediation
- Use parameterized queries and prepared statements for all database interactions.
- Apply context-aware output encoding for HTML, JavaScript, and URL contexts.
- Avoid executing shell commands (
exec,system) with dynamic user arguments.
A04:2021 - Insecure Design
A new category in 2021 representing architectural flaws that cannot be fixed by perfect code implementation alone. Insecure design reflects missing security controls and threat modeling during the initial design phase.
Real-World Example
A retail website allows password recovery by asking three predictable security questions ('What is your mother's maiden name?'). Even if the code has zero buffer overflows or SQLi bugs, the business logic design itself is inherently insecure.
A05:2021 - Security Misconfiguration
Security misconfigurations represent the most common operational weakness in cloud and web deployments:
- Leaving default administrative passwords unchanged (
admin:admin) - Exposing detailed stack traces and debugging pages in production environments
- Enabling unneeded HTTP methods (TRACE, PUT) or exposing cloud metadata ports
- Missing security headers (CSP, HSTS, X-Frame-Options)
- Misconfigured AWS S3 buckets or Cloud Storage permissions set to public read/write.
A06:2021 - Vulnerable and Outdated Components
Modern web applications are assembled from hundreds of open-source third-party dependencies. If a single dependency contains a known vulnerability (such as Log4Shell or Apache Struts RCE), the entire application is exposed.
Remediation
- Continuously run Software Composition Analysis (SCA) tools (
npm audit, Snyk, Dependabot) in CI/CD pipelines. - Maintain an updated Software Bill of Materials (SBOM).
- Lock dependency versions with lockfiles (
package-lock.json,pnpm-lock.yaml).
A07:2021 - Identification and Authentication Failures
Covers weaknesses in user identity confirmation:
- Permitting automated brute-force attacks and credential stuffing without rate limiting
- Permitting weak passwords (e.g., 'Password123')
- Failing to invalidate session tokens upon logout or password reset
- Exposing session IDs in URL query parameters
Remediation
- Enforce Multi-Factor Authentication (MFA) via TOTP or WebAuthn.
- Implement IP rate limiting and progressive delays on authentication endpoints.
- Regenerate session identifiers upon privilege elevation.
A08:2021 - Software and Data Integrity Failures
Focuses on code and infrastructure that does not protect against integrity violations:
- Insecure Deserialization: Deserializing untrusted object streams that execute arbitrary code (Python
pickle, JavaObjectInputStream, Nodenode-serialize). - CI/CD Supply Chain Compromise: Pulling build scripts from unverified third-party registries without subresource integrity (SRI) hashes.
- Unsigned auto-update mechanisms.
A09:2021 - Security Logging and Monitoring Failures
The average time to detect a corporate data breach exceeds 200 days. Without comprehensive audit logging, security incidents go unnoticed until external authorities report them.
Required Logging Events
- Failed and successful authentication attempts
- Access control rejections and permission denied errors
- Server-side input validation exceptions
- Administrative configuration modifications
A10:2021 - Server-Side Request Forgery (SSRF)
SSRF occurs when a web application fetches a remote resource (e.g., generating a link preview, importing a webhook, or downloading an image from a user-supplied URL) without validating the destination address. Attackers supply internal IP addresses (127.0.0.1, 10.0.0.0/8, or cloud metadata endpoints 169.254.169.254) to steal IAM credentials or scan internal VPCs.
// VULNERABLE SSRF: Blindly fetching user-supplied URL
app.post('/api/fetch-avatar', async (req, res) => {
// Attacker inputs: http://169.254.169.254/latest/meta-data/iam/security-credentials/
const response = await fetch(req.body.imageUrl);
res.send(await response.buffer());
});
// SAFE: Restrict to explicit allowlisted protocols and disallow private IP ranges
import ipaddr from 'ipaddr.js';
import dns from 'dns/promises';
export async function validateUrlNotInternal(targetUrl: string) {
const parsed = new URL(targetUrl);
if (!['http:', 'https:'].includes(parsed.protocol)) {
throw new Error('Disallowed protocol');
}
const { address } = await dns.lookup(parsed.hostname);
const ip = ipaddr.parse(address);
if (ip.range() !== 'unicast') {
throw new Error('Access to private/internal networks is prohibited');
}
}A04: Insecure Design vs. Insecure Implementation
The addition of A04:2021 Insecure Design represents a fundamental shift in AppSec philosophy. Historically, security focused almost exclusively on implementation flaws (e.g., missing sanitization or forgotten authorization checks). Insecure Design addresses flaws in the foundational business architecture that cannot be fixed by perfect code:
- Example of Insecure Design: Building an e-commerce checkout flow that allows the frontend to submit the total transaction price (
{ "itemId": 40, "price": 0.01 }). Even if the code has zero buffer overflows or SQL injection bugs, the design itself is fatally flawed. - Defensive Rule: Security must be integrated into the architecture through formal threat modeling (STRIDE methodology) before writing the first line of application code.
Common Mistakes to Avoid
❌Relying on client-side role checks while skipping backend authorization
Why it happens: Developers hide UI buttons (e.g., 'Delete User') for non-admin users in React.
Why it matters: Any user can inspect network traffic and send the underlying API request directly via curl.
Correct approach: Enforce authorization checks on every backend endpoint and database query.
❌Logging sensitive customer data (passwords, payment cards, SSNs) in debug logs
Why it happens: Developers write `console.log(req.body)` during development and leave it active in production.
Why it matters: Exposes sensitive credentials to anyone with access to log management platforms (Datadog, CloudWatch).
Correct approach: Implement log sanitization filters that redact sensitive fields prior to emission.
❌Assuming security can be addressed exclusively through code reviews at release time
Why it happens: Security is treated as a final checkbox before deployment.
Why it matters: Architectural flaws (Insecure Design) require expensive rewrites if caught late.
Correct approach: Shift security left: incorporate threat modeling during sprint design phases.
Troubleshooting Guide
Problem: DAST scanner flags Broken Access Control on endpoints with authentication enabled
Possible Causes:
- Endpoint requires authentication, but does not verify whether the authenticated user owns the specific requested record.
How to verify: Test the endpoint using credentials from User A while passing the ID belonging to User B.
How to fix: Add tenant isolation filters to the database query (`where: { id, tenantId }`).
Problem: Cloud metadata service SSRF payloads succeed despite regex URL validation
Possible Causes:
- Attacker used DNS rebinding or alternate IP encodings (e.g., `http://0x7f000001` or `http://2130706433`).
How to verify: Test URL resolution with alternative integer and hexadecimal IP representations.
How to fix: Resolve the hostname to an IP address via DNS and validate that the resolved IP does not fall into private RFC 1918 or link-local ranges.
Actionable Checklist
Wescequre Platform · Scanner Engine
Automated Vulnerability Scanner
Launch targeted or full-domain security audits to detect OWASP Top 10 vulnerabilities automatically.
Includes: OWASP Top 10 automated test suites · Real-time severity scoring (CVSS v3.1) · Instant remediation code snippets
Frequently Asked Questions
The OWASP Top 10 is typically updated every 3 to 4 years based on comprehensive empirical data gathered from thousands of organizations and security vendors.
While OWASP is an independent non-profit foundation, major regulatory frameworks (including PCI DSS Requirement 6.5, FTC settlements, and healthcare HIPAA guidelines) mandate compliance with OWASP Top 10 benchmarks.
Scanners detect injection, security misconfigurations, outdated components, and SSRF effectively. However, Insecure Design and business logic access control flaws require human threat modeling and penetration testing.
Authoritative Sources & References
- OWASP Top 10: 2021 Official DocumentationOWASP Foundation (official)View Source
- NIST Special Publication 800-53: Security and Privacy ControlsNIST (official)View Source
- PCI DSS v4.0: Requirement 6 - Develop and Maintain Secure SystemsPCI Security Standards Council (official)View Source
- OWASP: Application Security Verification Standard (ASVS v4.0.3)OWASP Foundation (official)View Source
Related Guides
Continue exploring related technical architecture and defensive guides
vulnerability scanning · DAST
What Is Vulnerability Scanning? Complete Guide
An authoritative guide to automated vulnerability scanning: how scanners crawl and audit applications, how DAST contrasts with SAST and SCA, and how to triage findings effectively.
SQL injection · database security
SQL Injection (SQLi) Explained: Types, Prevention & Testing
Deep technical breakdown of SQL injection: parser mechanics, Union-based and Blind attack vectors, ORM vulnerabilities, and parameterized query implementations.
API security · REST
REST API Security Best Practices for Modern Applications
Developer blueprint for securing REST APIs: BOLA/IDOR prevention patterns, asymmetric JWT validation, Redis token bucket rate limiting, and strict input DTOs.