OWASP Top 10: Each Risk and Java/Spring Mitigations

The OWASP Top 10 (2021) is the industry's consensus list of the most critical web application security risks.

The 10 risks

• A01 Broken Access Control
• A02 Cryptographic Failures
• A03 Injection
• A04 Insecure Design
• A05 Security Misconfiguration
• A06 Vulnerable & Outdated Components
• A07 Identification & Authentication Failures
• A08 Software & Data Integrity Failures
• A09 Security Logging & Monitoring Failures
• A10 Server-Side Request Forgery (SSRF)

What it is and isn't

• Community-driven ranked list, updated every 4 years (2021 current)
• Signal of what attackers target
• Common language for security/dev/management
• Basis for many SAST/DAST rules
• NOT complete standard, compliance checklist, or exhaustive guide
• IS a starting point for interview and production

Each risk with Java/Spring mitigations

A01 Broken Access Control (most common breach cause)

• Examples: URL manipulation, missing auth on admin, IDOR
• Fix: @PreAuthorize on service methods; default-deny .anyRequest().authenticated(); never trust client IDs; Spring Security ACLs for complex
• Detection: pen test, SAST, authz unit tests

A02 Cryptographic Failures

• Examples: plaintext passwords, weak hash (MD5/SHA-1), HTTP, weak TLS
• Fix: BCryptPasswordEncoder / Argon2; TLS 1.2+, HSTS, disable old ciphers; AES-GCM with proper IV; KMS for keys (AWS KMS, Vault); no custom crypto
• Detection: TLS scanners (testssl.sh), static analysis for weak algos

A03 Injection

• SQL, NoSQL, LDAP, OS command
• Fix: always parameterized queries (JPA, JdbcTemplate ? placeholders); never string concat; ProcessBuilder argv not shell; Bean Validation (@Valid @Pattern @Size); output encoding (Thymeleaf/React auto-escape)
• Detection: SAST, prepared statement linting

A04 Insecure Design

• Missing controls by design: no threat model, no rate limit, no MFA
• Fix: threat model early (STRIDE); @RateLimiter/Bucket4j; secure defaults at feature launch; security in design reviews
• Detection: design review process, pen test, security champions

A05 Security Misconfiguration

• Exposed actuator, default passwords, stack traces, lax CORS
• Fix: management.endpoints.web.exposure.include=health,info; ErrorController with ProblemDetail; CSP/HSTS/X-Content-Type-Options/X-Frame-Options headers; CORS explicit origins; disable server.error.include-stacktrace in prod
• Detection: config audit, IaC review, SecurityHeaders.com

A06 Vulnerable and Outdated Components

• Log4Shell, Spring4Shell, Jackson CVEs
• Fix: Dependabot/Renovate; OWASP Dependency-Check in CI; Snyk/Trivy; keep Spring Boot/JVM current; SBOM (CycloneDX/SPDX)
• Log4Shell lesson: upgrade to 2.17+ or remove JndiLookup

A07 Identification and Authentication Failures

• Credential stuffing, weak reset, session fixation, JWT without verification
• Fix: Spring Security (use, don't reinvent); org.passay for password strength; HIBP breached check; rate limit login + CAPTCHA lockout; MFA (TOTP/WebAuthn); session ID rotation; HttpOnly/Secure/SameSite cookies; JWT verify signature, no alg=none, short expiry + refresh; jose4j / nimbus-jose-jwt
• Detection: auth flow tests, pen test, login anomaly monitoring

A08 Software and Data Integrity Failures

• Unsigned updates, insecure deserialization, pipeline tampering, untrusted repos
• Fix: NO Java deserialization of untrusted; JSON instead; ObjectInputFilter whitelist; Jackson disable default typing, whitelist polymorphic; Maven Central GPG verification; signed commits, branch protection, least-privilege runners; SLSA framework; Sigstore/cosign for images
• Detection: SAST for readObject, pipeline audits

A09 Security Logging and Monitoring Failures

• No auth failure logs, logs discarded, no alerts
• Fix: log login success/failure, privilege changes, admin actions, data exports, errors; context via MDC (userId, IP, correlationId); centralize to SIEM (Splunk, Datadog, ELK); alerts on impossible-travel, brute force, anomalous DB access; GDPR/SOX retention; don't log secrets/PII — hash/redact
• Detection: log review, SIEM health, IR drills

A10 Server-Side Request Forgery (SSRF)

• User-supplied URL hits internal services (169.254.169.254 metadata, Redis)
• Fix: allowlist target hosts/domains; block private IPs (10/172.16/192.168/169.254/fc00::/7); egress proxy with allowlist (squid, Istio egress gateway); disable/validate redirects; IMDSv2 in AWS
• Detection: fuzz with internal URLs, monitor egress

Sane Spring Security 6 baseline

• @EnableWebSecurity + @EnableMethodSecurity
• CSRF enabled (except webhooks), CORS, security headers (CSP, HSTS, X-Frame-Options=DENY)
• Session management: IF_REQUIRED + migrateSession + max 1
• authorizeHttpRequests: permitAll public/health, hasRole ADMIN, anyRequest authenticated
• oauth2ResourceServer with JWT
• DelegatingPasswordEncoder (bcrypt default)

Method-level authz

• @PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")

Security automation in CI

• OWASP Dependency-Check: mvn org.owasp:dependency-check-maven:check
• Semgrep for SAST
• Trivy for container scan
• gitleaks for secret scan

Production headers

• Strict-Transport-Security, CSP, X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy

Testing security

• Unit: @WithMockUser, @WithMockJwt
• Integration: Keycloak via Testcontainers; real OAuth2 flows
• DAST: OWASP ZAP, Burp Suite against staging
• Pen test: regular third-party for critical apps

Defense in depth: no single control sufficient

• Example: search string input

1. 1
   Client-side validation (UX not security)
2. 2
   Bean Validation on DTO
3. 3
   Parameterized JPA query
4. 4
   Output encoding (auto-escape)
5. 5
   CSP header blocking inline scripts
6. 6
   WAF rules at edge
7. 7
   Logs + SIEM detection

Common Java/Spring pitfalls

1. 1
   Native SQL with string concat
2. 2
   ObjectMapper default typing enabled (polymorphic = arbitrary class instantiation)
3. 3
   JWT verification skipped or alg=none
4. 4
   @RestController without @PreAuthorize
5. 5
   Actuator exposed publicly (/env leaks vars, /heapdump gives memory)
6. 6
   CORS allowedOrigins=* with allowCredentials=true
7. 7
   Passwords logged during debug
8. 8
   DTOs trusting client-supplied fields (role=admin bound to entity)
9. 9
   File upload accepting any extension (.jsp to webroot = RCE)
10. 10
    XXE in old XML parsers (DocumentBuilderFactory must disable external entities)

Interview standouts

• Defense in depth, not silver bullets
• Least privilege: DB user, IAM role, file permissions
• Secrets in vault, not env/git/code
• Supply chain critical: Log4Shell was dep, not Spring's fault
• Usability: 60-day rotation discredited; length + MFA + breach monitoring beat frequent rotation
• Patching as service: owner, budget, SLOs on CVE time-to-patch
• Security champions: developers trained per team

Tooling stack

• Spring Security 6+
• OWASP Dependency-Check (A06)
• Snyk/Trivy (container + deps)
• Semgrep/SonarQube/CodeQL (SAST)
• OWASP ZAP (DAST)
• gitleaks/trufflehog (secrets)
• Keycloak/Auth0/Okta (identity — don't build auth)
• Vault/AWS Secrets Manager (secrets)
• Log aggregator (Datadog/Splunk/ELK) — A09
• WAF (AWS WAF, Cloudflare) — layer-7
• Runtime (Falco, Sysdig) — anomaly detection

Anti-patterns

• 'Security later' (retrofit 10x harder)
• Custom crypto
• Regex allowlists (bypass)
• Frontend-enforced authz
• Security through obscurity
• Ignoring low-severity findings
• No IR plan

Strategic take

• OWASP Top 10 = mindset: input is hostile, authn != authz, defaults leak, monitoring mandatory
• Java backend moves: use Spring Security, automate dep scan, centralize secrets/logs/auth, train team, test regularly, IR plan
• Interviews: naming is table stakes; connecting to specific tools and Spring config = real experience

Bottom line

• OWASP Top 10 is starting point, not exhaustive
• Spring Security + automation + defense-in-depth cover most
• Supply chain (A06) and logging (A09) under-appreciated but critical
• Tested security > theoretical security