Understanding OWASP Top 10 2021

The OWASP Top 10 is the de facto reference for the most critical web application security risks. The 2021 edition (the latest, with 2025 expected soon) introduced structural changes from 2017 — most notably combining some categories and elevating others based on real-world incident data. This post explains each category with examples.

A01:2021 — Broken Access Control

Up from #5 in 2017. The most common and impactful category. Failures let users act outside their intended permissions.

Examples:

• Viewing another user's order by changing ?order_id=123 to ?order_id=124
• Accessing admin endpoints by calling /api/admin/users as a regular user
• Modifying a JWT's role claim from user to admin

Fix: Enforce authorization server-side on every request. Use a central authorization middleware. Never trust client-side role checks.

js
// BAD
app.get("/api/orders/:id", (req, res) => {
  return Order.find(req.params.id);
});

// GOOD
app.get("/api/orders/:id", auth, (req, res) => {
  const order = await Order.find(req.params.id);
  if (order.userId !== req.user.id && req.user.role !== "admin") {
    return res.status(403).send("Forbidden");
  }
  return res.json(order);
});

A02:2021 — Cryptographic Failures

Renamed from "Sensitive Data Exposure". Focuses on failures in cryptography that expose data.

Examples:

• Storing passwords in plaintext or with weak hashing (MD5, SHA-1)
• Using ECB mode for symmetric encryption
• Hardcoded API keys in source code
• TLS not enforced (HTTP fallback)

Fix: Use bcrypt/argon2 for passwords. AES-256-GCM for symmetric encryption. TLS 1.3 everywhere. Rotate keys via a secrets manager (AWS KMS, HashiCorp Vault).

A03:2021 — Injection

Down from #1 (still huge). Includes SQLi, NoSQLi, OS command injection, LDAP injection, XPath injection, and template injection.

Fix: Parameterized queries, allow-list input validation, context-aware output encoding. GuardianX detects all injection variants via SAST.

A04:2021 — Insecure Design

New category in 2021. Focuses on architectural flaws — missing threat modeling, no rate limiting, no abuse cases considered.

Examples:

• A password reset flow that doesn't expire tokens
• A referral system that doesn't cap rewards per user
• An API with no pagination (allows data scraping)

Fix: Threat-model every new feature. Use abuse-case user stories. Implement rate limiting, CAPTCHA, and anomaly detection.

A05:2021 — Security Misconfiguration

Examples:

• Default credentials left in production
• Directory listing enabled
• Verbose error messages with stack traces
• Unnecessary features enabled (debug mode, admin UI)
• Missing security headers (CSP, HSTS, X-Frame-Options)

Fix: Harden infrastructure as code. Disable defaults. Add security headers via middleware. GuardianX scans for misconfigurations across your stack.

A06:2021 — Vulnerable and Outdated Components

Previously "Using Components with Known Vulnerabilities". Includes libraries, frameworks, OS packages.

Examples:

• An old version of log4j with CVE-2021-44228 (Log4Shell)
• Outdated npm packages with known CVEs
• Alpine base image missing security patches

Fix: SCA scanning (GuardianX SCA module), dependabot/renovate for auto-PRs, regular npm audit / pip-audit.

A07:2021 — Identification and Authentication Failures

Previously "Broken Authentication".

Examples:

• Weak passwords allowed (no minimum length, no breach check)
• No MFA on admin accounts
• Session IDs in URLs
• Session fixation after login
• Credential stuffing not blocked

Fix: Enforce strong passwords (>=12 chars, breached-password check via haveibeenpwned API). MFA everywhere. Rotating session IDs. Rate-limit login attempts.

A08:2021 — Software and Data Integrity Failures

New in 2021. Focuses on assumptions about software updates, CI/CD pipelines, and data integrity.

Examples:

• Unsigned npm packages (supply chain attacks)
• CI/CD pipelines with overly broad secrets
• Insecure deserialization (PHP unserialize, Python pickle)

Fix: Sign all packages. Lock dependency versions (package-lock.json, requirements.txt with hashes). Use signed commits. Avoid deserializing untrusted data — use JSON.

A09:2021 — Security Logging and Monitoring Failures

Examples:

• No audit log for sensitive actions (login, password change, data export)
• Logs not centralized (scattered across instances)
• No alerting on suspicious patterns (multiple failed logins)
• Logs deleted after 7 days (insufficient for forensic analysis)

Fix: Centralized logging (ELK, Splunk, Datadog). SIEM with correlation rules. Retention aligned with regulatory requirements (often 1 year). Real-time alerts on anomaly patterns.

A10:2021 — Server-Side Request Forgery (SSRF)

New in 2021 based on community survey. SSRF lets an attacker force the server to make requests to unintended destinations.

Examples:

• Image proxy that fetches http://169.254.169.254/latest/meta-data/ (AWS metadata)
• Webhook tester that can hit internal services

Fix: Allow-list outbound hosts. Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x, 127.x). Use a dedicated egress proxy. For AWS, use IMDSv2 (token-based metadata API).

Beyond the Top 10

The OWASP Top 10 is a floor, not a ceiling. Modern applications also face:

• Business logic vulnerabilities (the Top 10 doesn't cover these well)
• API security (see OWASP API Security Top 10)
• Cloud misconfigurations (see OWASP Cloud-Native Application Security Top 10)
• Supply chain attacks
• LLM prompt injection (OWASP LLM Top 10)

GuardianX's SAST + DAST engines cover all 10 OWASP categories plus 17 additional vulnerability classes. Sign up for a scan to see where your application stands.