Application Security

OWASP Top 10 (2021)

1. Broken Access Control

Risk: Users accessing unauthorized resources.

Prevention:

• Deny by default

• Implement RBAC/ABAC

• Validate permissions server-side

• Log access failures

2. Cryptographic Failures

Risk: Sensitive data exposure.

Prevention:

• Encrypt data at rest and in transit

• Use strong algorithms (AES-256, RSA-2048+)

• Never store passwords in plaintext

• Use secure key management

3. Injection

Risk: Malicious input executed as code.

Prevention:

// ❌ BAD - SQL injection vulnerability @GetMapping("/users/{id}") public User getUser(@PathVariable String id) { String query = "SELECT * FROM users WHERE id = " + id; return jdbcTemplate.queryForObject(query, User.class); }

// ✅ GOOD - Use JPA/Spring Data (parameterized by default) @Repository public interface UserRepository extends JpaRepository<User, Long> { Optional<User> findById(Long id); }

// ✅ GOOD - JPQL with named parameters @Query("SELECT u FROM User u WHERE u.email = :email AND u.status = :status") Optional<User> findByEmailAndStatus( @Param("email") String email, @Param("status") UserStatus status );

// ❌ BAD - Command injection Runtime.getRuntime().exec("ls " + userInput);

// ✅ GOOD - Use ProcessBuilder with separate arguments ProcessBuilder pb = new ProcessBuilder("ls", userInput); Process p = pb.start();

4. Insecure Design

Risk: Missing security controls by design.

Prevention:

• Threat modeling

• Security requirements

• Defense in depth

5. Security Misconfiguration

Risk: Default or weak configuration.

Prevention:

• Disable unnecessary features

• Remove default credentials

• Keep software updated

• Harden server configuration

6. Vulnerable Components

Risk: Using libraries with known vulnerabilities.

Prevention:

• Regular dependency audits

• Keep dependencies updated

• Monitor CVE databases

7. Authentication Failures

Risk: Weak or broken authentication.

Prevention:

• Multi-factor authentication

• Strong password policies

• Secure session management

• Rate limiting on login

8. Software & Data Integrity

Risk: Untrusted sources for updates.

Prevention:

• Verify code signatures

• Use SRI for CDN resources

• Secure CI/CD pipeline

9. Logging & Monitoring Failures

Risk: Attacks go undetected.

Prevention:

• Log security events

• Monitor for anomalies

• Alert on suspicious activity

10. Server-Side Request Forgery

Risk: Server makes requests to unintended destinations.

Prevention:

• Validate URLs

• Use allowlists

• Block internal IPs