Most modern attacks target applications, making secure software development a frontline concern. The OWASP Top 10 is a periodically updated list of the most critical web application security risks. In 2021, the leading category was A01: Broken Access Control, the most common serious vulnerability, often caused by trusting client-side checks. A02 was Cryptographic Failures, formerly known as Sensitive Data Exposure. Related access issues include Insecure Direct Object References (IDOR), where internal IDs are exposed without authorization checks, and privilege escalation, where an attacker gains higher permissions. Vertical privilege escalation elevates a standard user to admin, while horizontal escalation lets user A access user B's data at the same privilege level. Other critical web risks include Remote Code Execution (RCE), Server-Side Request Forgery (SSRF), CRLF injection that manipulates HTTP headers, XML External Entity (XXE) attacks that abuse XML parsers, path traversal using ../ sequences to escape directories, and open redirects used to funnel users into phishing sites.
Injection flaws remain a staple of web attacks. SQL injection inserts malicious SQL code into input fields that are passed directly to a database query without proper sanitization, exploiting improper input validation and allowing attackers to read, modify, or delete database contents. Prevention relies on parameterized queries or prepared statements, which use placeholders so values are bound separately and cannot be interpreted as SQL; user input must never be concatenated into queries. Cross-Site Scripting (XSS) injects malicious scripts into web pages viewed by other users. Stored XSS persists on the server, for example in a forum post, and affects every visitor; reflected XSS is embedded in a URL and executes only when a victim clicks the crafted link; DOM-based XSS executes in client-side JavaScript. Defenses include contextual output encoding, Content Security Policy (CSP) headers that restrict what resources a page can load, input validation, framework auto-escaping, and the HttpOnly cookie attribute that prevents JavaScript from accessing session cookies.
Cross-Site Request Forgery (CSRF) tricks a user's browser into making unwanted authenticated requests. Defenses include CSRF tokens, which are random tokens tied to the user session that must accompany state-changing requests and cannot be forged by attackers, the SameSite cookie attribute (Strict, Lax, or None) that controls whether cookies are sent on cross-site requests, double-submit patterns, custom request headers, and Origin header checks. The Secure attribute ensures cookies are sent only over HTTPS. Browsers enforce the Same-Origin Policy (SOP), restricting scripts from interacting across origins, while Cross-Origin Resource Sharing (CORS) is the server-controlled relaxation of SOP for legitimate cross-origin requests, signaled by headers such as Access-Control-Allow-Origin and Access-Control-Allow-Credentials. Browsers send an OPTIONS preflight before non-simple cross-origin requests. A rich set of security headers hardens the browser side: CSP restricts resource loading, HSTS enforces HTTPS, X-Frame-Options (now largely superseded by CSP frame-ancestors) prevents the page from being embedded in iframes to defeat clickjacking, X-Content-Type-Options: nosniff prevents MIME-sniffing attacks, Referrer-Policy limits referrer leakage, and Permissions-Policy controls which browser features a page may use. DevSecOps integrates security into DevOps through security as code and automated pipelines, supported by Static Application Security Testing (SAST) on source code, Dynamic Application Security Testing (DAST) on running apps, Interactive AST (IAST) that combines both, and Software Composition Analysis (SCA) that scans dependencies for known vulnerabilities. Data Loss Prevention (DLP) tools and policies prevent sensitive data from leaving the organization, and data classification schemes categorize data by sensitivity so appropriate protections can be applied.