The Open Worldwide Application Security Project (OWASP) publishes a regularly updated list of the ten most critical web application security risks, and the 2021 edition includes broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity failures, logging failures, and server-side request forgery (SSRF). Many of these risks manifest as well-known attack patterns that developers must learn to recognize and prevent. Cross-Site Scripting (XSS), for instance, lets an attacker inject malicious scripts into pages viewed by other users, and it appears in three forms: reflected XSS, where input from a request is bounced straight back in the response without encoding; stored XSS, where the payload is persisted on the server (for example, in a comment database) and served to every viewer; and DOM-based XSS, where vulnerable client-side JavaScript reads untrusted data from sources like location.hash and writes it to the page using unsafe APIs such as innerHTML or document.write.
Cross-Site Request Forgery (CSRF) takes a different angle: it tricks a victim's browser into issuing an unwanted request to a site where they are already authenticated, such as a hidden form posting to a banking endpoint. Defenses include per-request tokens, the SameSite cookie attribute, and checks on the Origin and Referer headers. SQL injection is another classic danger, occurring when untrusted input is concatenated into SQL queries and allowing attackers to run arbitrary statements like the infamous ' OR '1'='1' trick. The primary defense is parameterized queries, sometimes called prepared statements, which separate SQL code from data using placeholders so that the database engine never interprets user input as executable code. The same general principle applies to command injection, where unsanitized input reaches a system shell: developers should avoid invoking operating system commands entirely when possible, prefer language-native APIs, and otherwise pass arguments as separate array elements rather than as an interpolated string.
Beyond these, several other vulnerabilities round out the threat landscape. Broken access control, the top item on the OWASP list, lets users act outside their intended permissions, and Insecure Direct Object References (IDOR) are a particularly common variant, where simply changing a numeric ID in a URL exposes another user's data. SSRF tricks the server itself into making requests to unintended destinations, often internal services or cloud metadata endpoints, and can be mitigated with allowlists and blocked private IP ranges. Clickjacking, also called UI redressing, overlays a transparent iframe on a legitimate page so users click on hidden elements instead of what they see, and is blocked using X-Frame-Options or a Content-Security-Policy frame-ancestors directive. Security misconfiguration, meanwhile, is a broad category that includes unchanged default credentials, unnecessary features, missing security headers, verbose error messages, and unpatched software, all of which can be addressed through automated scanning, minimal installations, and infrastructure-as-code practices.