සිං | தமிழ் | EN

Web Application Security

OWASP Top 10 web vulnerabilities, Web Application Firewalls (WAFs), and secure API development.

“ Web application security is not a one-time task; it’s an ongoing process that demands continuous attention, evolution, and resilience.” — Brian Honan

Web Application Security

Web applications are the backbone of the modern internet, powering everything from online shopping and banking to social media and entertainment. However, web applications are also prime targets for cyberattacks, making web application security a critical concern for organizations of all sizes. This article explores the key aspects of web application security, focusing on the OWASP Top 10 vulnerabilities, Web Application Firewalls (WAFs), and secure API development.

OWASP Top 10 Web Vulnerabilities

The Open Web Application Security Project (OWASP) Top 10 is a globally recognized standard awareness document for web application security. It represents a broad consensus about the most critical security risks to web applications.

A1:2021 - Broken Access Control

  • Description: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data, or performing a business function outside the user’s limits.
  • Examples:
    • Accessing other users’ accounts.
    • Viewing sensitive files, such as financial records or source code.
    • Modifying data without proper authorization.
    • Bypassing access control checks by manipulating URLs or parameters.
  • Mitigation:
    • Implement strict access control mechanisms, such as role-based access control (RBAC).
    • Enforce the principle of least privilege, granting users only the necessary permissions.
    • Regularly review and update access rights.
    • Perform thorough testing to ensure access controls are working as intended.

A2:2021 - Cryptographic Failures

  • Description: Now the first vulnerability on the list, this category represents a generalized risk of sensitive data exposure when it is not properly protected.
  • Examples:
    • Storing passwords in plain text.
    • Using weak encryption algorithms or key management practices.
    • Failing to protect sensitive data in transit using HTTPS.
    • Not hashing or encrypting sensitive data at rest.
  • Mitigation:
    • Use strong encryption algorithms and key management practices.
    • Hash passwords securely using strong hashing algorithms like bcrypt or Argon2.
    • Protect sensitive data both in transit and at rest using encryption.
    • Regularly review and update cryptographic controls to ensure they remain effective.

A3:2021 - Injection

  • Description: Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
  • Examples:
    • SQL injection: Injecting malicious SQL code into a web application to manipulate database queries.
    • Cross-site scripting (XSS): Injecting malicious JavaScript code into a web page to steal user data or hijack sessions.
    • Command injection: Injecting operating system commands into a web application to execute arbitrary commands on the server.
  • Mitigation:
    • Sanitize all user input to prevent injection attacks.
    • Use parameterized queries or prepared statements to prevent SQL injection.
    • Implement output encoding to prevent XSS.
    • Use a web application firewall (WAF) to detect and block injection attacks.

A4:2021 - Insecure Design

  • Description: Insecure design is a broad category that encompasses security flaws that originate from design flaws. If we genuinely want to “move left” as an industry, we need more threat modeling, secure design patterns and principles, and reference architectures.
  • Examples:
    • Failing to consider security requirements in the design phase.
    • Using insecure architectural patterns.
    • Not implementing security controls for sensitive data.
    • Designing systems that are difficult to secure and maintain.
  • Mitigation:
    • Establish secure design patterns and principles.
    • Perform threat modeling to identify potential security risks early in the design phase.
    • Define security requirements and incorporate them into the design process.
    • Use secure frameworks and libraries to build applications.

A5:2021 - Security Misconfiguration

  • Description: Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.
  • Examples:
    • Using default passwords or accounts.
    • Leaving unnecessary services or ports open.
    • Not properly configuring security headers, such as Content Security Policy (CSP).
    • Storing sensitive information in configuration files.
  • Mitigation:
    • Establish secure configuration standards for all systems and applications.
    • Automate configuration management to ensure consistency and reduce human error.
    • Regularly review and update configurations to address new vulnerabilities and threats.
    • Use security scanning tools to identify misconfigurations.

A6:2021 - Vulnerable and Outdated Components

  • Description: Using components with known vulnerabilities can expose applications to attacks. This includes outdated software libraries, frameworks, and other components.
  • Examples:
    • Using an outdated version of a web server.
    • Including a vulnerable JavaScript library in a web application.
    • Relying on a third-party component with a known security flaw.
  • Mitigation:
    • Inventory all components used in applications and systems.
    • Keep components updated to the latest versions to patch vulnerabilities.
    • Use vulnerability scanning tools to identify and remediate vulnerabilities in components.
    • Consider using software composition analysis (SCA) tools to track and manage open source components.

A7:2021 - Identification and Authentication Failures

  • Description: Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently.
  • Examples:
    • Using weak passwords or password policies.
    • Not implementing multi-factor authentication (MFA).
    • Failing to protect session tokens from theft or replay attacks.
    • Allowing brute-force attacks against user accounts.
  • Mitigation:
    • Implement strong authentication mechanisms, such as MFA.
    • Protect passwords and session tokens using strong encryption and secure storage.
    • Enforce strong password complexity requirements and password rotation policies.
    • Use account lockout mechanisms to prevent brute-force attacks.

A8:2021 - Software and Data Integrity Failures

  • Description: Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations. An example of this is where an application relies upon plugins, libraries, or modules from untrusted sources, repositories, and content delivery networks (CDNs).
  • Examples:
    • Using untrusted third-party libraries or components.
    • Failing to validate data integrity before processing it.
    • Not using digital signatures to verify software authenticity.
    • Allowing unauthorized modifications to data or code.
  • Mitigation:
    • Use digital signatures to verify software integrity.
    • Implement strong data validation mechanisms to ensure data accuracy and consistency.
    • Use software composition analysis (SCA) tools to identify vulnerabilities in third-party components.
    • Securely manage and control access to software repositories and build pipelines.

A9:2021 - Security Logging and Monitoring Failures

  • Description: Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data.
  • Examples:
    • Not logging security-relevant events, such as login attempts and data access.
    • Failing to monitor logs for suspicious activity.
    • Not integrating logs with security information and event management (SIEM) systems.
    • Lacking an incident response plan or failing to test it regularly.
  • Mitigation:
    • Implement comprehensive logging and monitoring to capture security-relevant events.
    • Integrate logs with SIEM systems for centralized analysis and alerting.
    • Establish and regularly test an incident response plan.
    • Use threat intelligence to identify and respond to emerging threats.

A10:2021 - Server-Side Request Forgery (SSRF)

  • Description: SSRF flaws occur whenever a web application fetches a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list (ACL).
  • Examples:
    • Allowing users to provide URLs that the application will fetch and display.
    • Using user-supplied URLs to access internal resources or services.
    • Failing to validate URLs before making requests to them.
  • Mitigation:
    • Sanitize user input and validate all client-supplied input data.
    • Enforce allow lists for server-side requests to restrict access to trusted resources.
    • Disable HTTP redirects on server-side requests.

Web Application Firewalls (WAFs)

Web Application Firewalls (WAFs) are a critical security control for protecting web applications from attacks.

How WAFs Work

WAFs act as a barrier between web applications and the internet, filtering malicious traffic and preventing it from reaching the application. They analyze incoming HTTP requests and block those that match known attack patterns or violate security policies.

Benefits of WAFs

  • Protection from common attacks: WAFs protect against a wide range of attacks, including SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).
  • Reduced risk of data breaches: By blocking malicious traffic, WAFs help prevent data breaches and protect sensitive information.
  • Improved compliance: WAFs can help organizations comply with security regulations, such as PCI DSS.
  • Simplified security management: WAFs can be easily deployed and managed, reducing the burden on security teams.

Secure API Development

APIs (Application Programming Interfaces) are essential for modern web applications, enabling communication and data exchange between different systems. However, APIs can also be vulnerable to attacks if not properly secured.

Secure API Development Practices

  • Authentication and authorization: Implement strong authentication and authorization mechanisms to control access to APIs. This may involve using API keys, OAuth 2.0, or other authentication protocols.
  • Input validation: Validate all API requests to prevent injection attacks and other vulnerabilities. This includes validating data types, formats, and ranges.
  • Output encoding: Encode API responses to prevent XSS and other attacks. This involves encoding data in a format that is safe to display in a web browser or other client application.
  • Rate limiting: Limit the number of requests that can be made to an API to prevent denial-of-service (DoS) attacks. This can be done by limiting the number of requests per IP address or user account.
  • Security testing: Conduct thorough security testing to identify and remediate API vulnerabilities. This may involve using automated tools, manual testing, and penetration testing.

Conclusion

Web application security is a critical concern in today’s interconnected world. By understanding the OWASP Top 10 vulnerabilities, implementing secure development practices, and utilizing WAFs, organizations can build and deploy secure web applications that protect user data and ensure business continuity.

Further Reading

GPT Prompts

  • What are the OWASP Top 10 web application vulnerabilities and how can they be mitigated?
  • How can organizations prioritize and address the OWASP Top 10 vulnerabilities based on their specific risk profile?
  • What are the latest trends in web application attacks, and how are they reflected in the OWASP Top 10?
  • How do Web Application Firewalls (WAFs) work and what are their benefits and limitations?
  • What are the different types of WAFs, and how do they compare in terms of features and effectiveness?
  • How can organizations choose the right WAF solution for their specific needs and environment?
  • What are the best practices for developing secure APIs, including authentication, authorization, and input validation?
  • How can organizations ensure the security of their APIs throughout the API lifecycle, from design to deployment and maintenance?
  • What are the emerging trends in API security, such as API gateways and API security testing tools?
© 2025 - National Digital Capacity Library, Sri Lanka
This work is licensed under a Creative Commons Attribution 4.0 International License.
Creative Commons License