OWASP Top 10 — Critical Web Vulnerabilities

Q: OWASP Top 10 — Critical Web Vulnerabilities

The **OWASP Top 10** is the standard awareness document for the most critical web application security risks. The **2021 edition** moved **Broken Access Control to #1** (most common breach cause), introduced **Insecure Design (#4)**, **Software/Data Integrity Failures (#8)**, and **SSRF (#10)**, and demoted Injection from #1 to #3 (XSS folded in). Knowing the current list signals practitioner-level security awareness and lets you map each category to a concrete Spring Boot defense — `@PreAuthorize` for A01, `BCryptPasswordEncoder` for A02, parameterized JPA queries for A03, threat modeling for A04, locked-down actuators for A05.

Intermediate·4 min read·

FintechEnterpriseStartupE-commerceHealthcare

Fast recall

Quick revision

Core answer

The OWASP Top 10 is the standard awareness document for the most critical web application security risks. The 2021 edition moved Broken Access Control to #1 (most common breach cause), introduced Insecure Design (#4), Software/Data Integrity Failures (#8), and SSRF (#10), and demoted Injection from #1 to #3 (XSS folded in). Knowing the current list signals practitioner-level security awareness and lets you map each category to a concrete Spring Boot defense — @PreAuthorize for A01, BCryptPasswordEncoder for A02, parameterized JPA queries for A03, threat modeling for A04, locked-down actuators for A05.

Interview-ready guide

Interview answer

The 2021 list, with Spring fixes

A01 Broken Access Control

Users accessing other users' data, missing checks, IDOR
Spring fix: @PreAuthorize("#id == authentication.name"), ownership checks in service layer

A02 Cryptographic Failures

Plaintext or weakly-hashed passwords
Spring fix: BCryptPasswordEncoder or Argon2PasswordEncoder

A03 Injection

User input in queries or commands
Spring fix: JPA @Query with parameters, @Valid

A04 Insecure Design (NEW)

Architectural flaws not fixable by code patches
Spring fix: threat modeling during design

A05 Security Misconfiguration

Default creds, verbose errors, exposed actuators
Spring fix: lock actuators, hide stack traces, enforce HTTPS

A07 Authentication Failures

No lockout, no rate limit, weak passwords
Spring fix: brute-force protection, BCrypt high cost, password policy

A10 SSRF (NEW)

Server fetches attacker URL -> cloud metadata theft
Spring fix: URL allowlist, IMDSv2

Key interview signal

Cite the 2021 list, not 2017
Map each category to a Spring mitigation
Mention threat modeling for A04 (the one that can't be code-patched)

03 · Deep dive

OWASP Top 10 — Critical Web Vulnerabilities

About 5 min with examples

Direct Answer

Code Example

The OWASP Top 10 (2021) lists the most common web-app risks. Most are preventable in Spring with configuration plus a few guard rails.

java

A01 Broken Access Control — method security + explicit rules, never URL guessworkAnti-pattern

// A01 Broken Access Control — method security + explicit rules, never URL guesswork
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
public UserDto getUser(@PathVariable Long userId) { ... }

// A02 Cryptographic Failures — BCrypt for passwords, TLS everywhere
@Bean PasswordEncoder encoder() { return new BCryptPasswordEncoder(12); }

// A03 Injection — use PreparedStatement / JPA parameters; NEVER concat SQL
@Query("SELECT u FROM User u WHERE u.email = :email")          // safe (bind parameter)
Optional<User> findByEmail(@Param("email") String email);
// em.createNativeQuery("SELECT ... WHERE email = '" + email + "'")  <-- BANNED

// A04 Insecure Design — rate limiting + idempotency keys on mutating endpoints
@RateLimiter(name = "loginLimiter", fallbackMethod = "tooManyRequests")
public ResponseEntity<?> login(...) { ... }

// A05 Security Misconfiguration — headers, CSRF, CORS, actuator lockdown
@Bean SecurityFilterChain security(HttpSecurity http) throws Exception {
    return http
        .csrf(c -> c.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()))
        .headers(h -> h
            .contentSecurityPolicy(cp -> cp.policyDirectives("default-src 'self'"))
            .frameOptions(f -> f.deny())
            .httpStrictTransportSecurity(s -> s.maxAgeInSeconds(31_536_000)))
        .authorizeHttpRequests(a -> a
            .requestMatchers("/actuator/**").hasRole("ADMIN")
            .anyRequest().authenticated())
        .build();
}

// A07 Identification & Authentication Failures — lockout + MFA
public class LoginAttemptService {
    private final Cache<String, Integer> attempts = Caffeine.newBuilder()
        .expireAfterWrite(Duration.ofMinutes(15)).build();
    public boolean isBlocked(String user) { return attempts.get(user, k -> 0) >= 5; }
}

// A08 Software and Data Integrity — verify dependency signatures, sign JARs in CI
// A09 Logging & Monitoring — log auth events, never log tokens/passwords
logger.info("Login success user={} ip={}", user.getEmail(), ip);   // NO password, NO JWT

A01 / A03 cause the majority of real exploits — enforce method security (@PreAuthorize) on services and always bind parameters.
A05 is the cheapest to fix: enable CSRF, set HSTS + CSP, lock down /actuator, disable stack traces in responses (server.error.include-message=never).
Run OWASP Dependency-Check (dependency-check-maven) in CI to catch A06 (Vulnerable Components). Fail the build on CVSS ≥ 7.
Never log secrets. Use a dedicated security event logger (AUDIT.info(...)) routed to a separate index so SOC teams can alert on it.

Common Mistakes & Pitfalls

Listing only SQL injection and XSS while missing newer categories like Insecure Design or SSRF.

Check your understanding

Answer these without looking back at the article.

Which OWASP category would a missing @PreAuthorize annotation violate?
How would you integrate OWASP Dependency-Check into a Maven build pipeline?
What changed between the 2017 and 2021 OWASP Top 10 editions?
How would you defend a service with a URL-fetching feature against SSRF?

Authentication Strategies: JWT vs Session vs OAuth2 vs SAML

Continue · Next question · Q 23/26

SQL Injection — How It Works and JPA Prevention

Spring Ecosystem

Spring Core, Boot, Data JPA, Security, WebFlux & Batch

Application Security

OWASP, authentication, authorization, OAuth2 & JWT

Full prep

Looking for a structured roadmap?

Every module on this page is also part of the full Java backend interview track.

Open the full roadmap Browse all prep categories

OWASP Top 10 — Critical Web Vulnerabilities

Fast recall

Quick revision

Core answer

Interview-ready guide

Interview answer

The 2021 list, with Spring fixes

A01 Broken Access Control

Users accessing other users' data, missing checks, IDOR
Spring fix: @PreAuthorize("#id == authentication.name"), ownership checks in service layer

A02 Cryptographic Failures

Plaintext or weakly-hashed passwords
Spring fix: BCryptPasswordEncoder or Argon2PasswordEncoder

A03 Injection

User input in queries or commands
Spring fix: JPA @Query with parameters, @Valid

A04 Insecure Design (NEW)

Architectural flaws not fixable by code patches
Spring fix: threat modeling during design

A05 Security Misconfiguration

Default creds, verbose errors, exposed actuators
Spring fix: lock actuators, hide stack traces, enforce HTTPS

A07 Authentication Failures

No lockout, no rate limit, weak passwords
Spring fix: brute-force protection, BCrypt high cost, password policy

A10 SSRF (NEW)

Server fetches attacker URL -> cloud metadata theft
Spring fix: URL allowlist, IMDSv2

Key interview signal

Cite the 2021 list, not 2017
Map each category to a Spring mitigation
Mention threat modeling for A04 (the one that can't be code-patched)

03 · Deep dive

OWASP Top 10 — Critical Web Vulnerabilities

About 5 min with examples

Direct Answer

Code Example

The OWASP Top 10 (2021) lists the most common web-app risks. Most are preventable in Spring with configuration plus a few guard rails.

java

A01 Broken Access Control — method security + explicit rules, never URL guessworkAnti-pattern

// A01 Broken Access Control — method security + explicit rules, never URL guesswork
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
public UserDto getUser(@PathVariable Long userId) { ... }

// A02 Cryptographic Failures — BCrypt for passwords, TLS everywhere
@Bean PasswordEncoder encoder() { return new BCryptPasswordEncoder(12); }

// A03 Injection — use PreparedStatement / JPA parameters; NEVER concat SQL
@Query("SELECT u FROM User u WHERE u.email = :email")          // safe (bind parameter)
Optional<User> findByEmail(@Param("email") String email);
// em.createNativeQuery("SELECT ... WHERE email = '" + email + "'")  <-- BANNED

// A04 Insecure Design — rate limiting + idempotency keys on mutating endpoints
@RateLimiter(name = "loginLimiter", fallbackMethod = "tooManyRequests")
public ResponseEntity<?> login(...) { ... }

// A05 Security Misconfiguration — headers, CSRF, CORS, actuator lockdown
@Bean SecurityFilterChain security(HttpSecurity http) throws Exception {
    return http
        .csrf(c -> c.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()))
        .headers(h -> h
            .contentSecurityPolicy(cp -> cp.policyDirectives("default-src 'self'"))
            .frameOptions(f -> f.deny())
            .httpStrictTransportSecurity(s -> s.maxAgeInSeconds(31_536_000)))
        .authorizeHttpRequests(a -> a
            .requestMatchers("/actuator/**").hasRole("ADMIN")
            .anyRequest().authenticated())
        .build();
}

// A07 Identification & Authentication Failures — lockout + MFA
public class LoginAttemptService {
    private final Cache<String, Integer> attempts = Caffeine.newBuilder()
        .expireAfterWrite(Duration.ofMinutes(15)).build();
    public boolean isBlocked(String user) { return attempts.get(user, k -> 0) >= 5; }
}

// A08 Software and Data Integrity — verify dependency signatures, sign JARs in CI
// A09 Logging & Monitoring — log auth events, never log tokens/passwords
logger.info("Login success user={} ip={}", user.getEmail(), ip);   // NO password, NO JWT

A01 / A03 cause the majority of real exploits — enforce method security (@PreAuthorize) on services and always bind parameters.
A05 is the cheapest to fix: enable CSRF, set HSTS + CSP, lock down /actuator, disable stack traces in responses (server.error.include-message=never).
Run OWASP Dependency-Check (dependency-check-maven) in CI to catch A06 (Vulnerable Components). Fail the build on CVSS ≥ 7.
Never log secrets. Use a dedicated security event logger (AUDIT.info(...)) routed to a separate index so SOC teams can alert on it.

Common Mistakes & Pitfalls

Listing only SQL injection and XSS while missing newer categories like Insecure Design or SSRF.

Check your understanding

Answer these without looking back at the article.

Which OWASP category would a missing @PreAuthorize annotation violate?
How would you integrate OWASP Dependency-Check into a Maven build pipeline?
What changed between the 2017 and 2021 OWASP Top 10 editions?
How would you defend a service with a URL-fetching feature against SSRF?

Full prep

Looking for a structured roadmap?

Every module on this page is also part of the full Java backend interview track.

Open the full roadmap Browse all prep categories

OWASP Top 10 — Critical Web Vulnerabilities

Direct Answer

Code Example

Common Mistakes & Pitfalls

Check your understanding

Related interview prep categories

Looking for a structured roadmap?

OWASP Top 10 — Critical Web Vulnerabilities

Direct Answer

Code Example

Common Mistakes & Pitfalls

Check your understanding

Related interview prep categories

Looking for a structured roadmap?