Web Application Security: OWASP Top 10 Mitigations
Cyberattacks against web applications continue to escalate in frequency and sophistication. According to security industry reports, over 70% of production data breaches stem from web application vulnerabilities — including un-sanitized SQL queries, broken authorization checks, and cross-site scripting (XSS) flaws.
The OWASP Top 10 represents the authoritative standard for critical web application security risks. Securing modern applications requires embedding security controls directly into application source code, API gateways, and CI/CD deployment pipelines rather than relying solely on external firewalls. This guide details defense-in-depth security strategies, parameterized SQL queries, Content Security Policies (CSP), SSRF mitigations, and automated SAST/DAST scanning.
Mental Model: Perimeter Defense vs Defense-in-Depth Application Security
Relying exclusively on perimeter Web Application Firewalls (WAFs) creates a false sense of security. WAF rules can be bypassed using obfuscated payloads or zero-day exploits, leaving unhardened backend microservices exposed.
Defense-in-Depth Application Security embeds security controls across every layer of the architecture: 1. Edge / Gateway: TLS 1.3 encryption, rate limiting, and IP whitelisting. 2. Application Code: Input validation, parameterized queries, and context-aware output encoding. 3. Database / Storage: Least-privilege database user permissions and column-level encryption. 4. Infrastructure: Immutable container images and non-root execution. For API security patterns, review securing rest apis oauth2 jwt best practices and securing microservices api gateway kong keycloak.
Quick reference
- Defense-in-Depth embeds security controls across Edge, Application Code, Database, and OS layers.
- Eliminates single points of security compromise by assuming perimeter WAF firewalls will be bypassed.
- Enforces least-privilege access rules for database connection strings and microservice IAM roles.
- Reduces security vulnerability blast radius through network isolation and container security.
- Aligns development practices with OWASP ASVS (Application Security Verification Standard).
Remember this
Adopt a defense-in-depth architecture to secure web applications at the code, API, and database layers.
Preventing Injection (SQLi, Commandi) & Broken Access Controls (IDOR)
Injection flaws and Broken Access Controls consistently rank as the top 2 OWASP vulnerabilities:
1. SQL Injection (A03:2021-Injection): Never concatenate user input directly into SQL strings. Always use parameterized prepared statements or ORMs (Drizzle, Prisma, TypeORM):
1// SECURE: Parameterized prepared statement2const user = await db.query("SELECT * FROM users WHERE email = $1", [userInputEmail]);2. Insecure Direct Object References (A01:2021-Broken Access Control): Attackers modify URL parameters (/api/invoices/1002) to view other users' private data. Enforce server-side authorization checks on every request, verifying that invoice.owner_id === authenticatedUser.id before returning records.
Quick reference
- Parameterized SQL queries completely neutralize SQL injection by separating code from data.
- Object-Relational Mappers (ORMs) escape query parameters automatically by default.
- Broken Access Control (IDOR) requires explicit server-side user ownership checks on every API route.
- Never trust client-supplied user IDs or role attributes in JWT payloads or request bodies.
- Use UUID v4 identifiers instead of sequential integer IDs to prevent resource enumeration.
Remember this
Use parameterized SQL statements and enforce server-side ownership checks to stop Injection and IDOR vulnerabilities.
Mitigating Cross-Site Scripting (XSS) & Server-Side Request Forgery (SSRF)
Client-side and server-side injection vulnerabilities compromise user sessions and internal infrastructure:
- Cross-Site Scripting (A03:XSS): Occurs when un-sanitized user input is rendered into the DOM, allowing attackers to execute malicious JavaScript. Modern React and Next.js escape JSX strings automatically. For raw HTML rendering, sanitize inputs using DOMPurify and set HttpOnly flags on session cookies.
- Server-Side Request Forgery (A10:SSRF): Occurs when backend servers fetch user-supplied URLs (e.g., webhook testing). Attackers pass internal metadata URLs (http://169.254.169.254/latest/meta-data/) to steal AWS IAM credentials. Block SSRF by resolving DNS hostnames and rejecting private RFC 1918 / Cloud Metadata IP addresses before executing HTTP requests.
Quick reference
- React JSX escapes strings automatically; use DOMPurify for HTML dangerouslySetInnerHTML rendering.
- Set HttpOnly, Secure, and SameSite=Strict flags on session cookies to prevent XSS cookie theft.
- Block SSRF by validating user-supplied URLs against private IP ranges (10.0.0.0/8, 169.254.169.254).
- Run outbound HTTP fetches inside isolated egress proxies with strict IP whitelist rules.
- Disable dangerous URL redirect follows in backend HTTP client libraries.
Remember this
Sanitize HTML rendering with DOMPurify and block private IP ranges on backend fetches to prevent XSS and SSRF.
Security Headers (CSP, HSTS), Dependency Scanning, & SAST/DAST CI Integration
Automating security checks in CI/CD pipelines ensures vulnerabilities are caught before reaching production:
1. HTTP Security Headers: Configure Next.js headers or NGINX to emit strict security directives:
1// next.config.js2headers: async () => [{3 source: '/(.*)',4 headers: [5 { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self' 'nonce-...";" },6 { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },7 { key: 'X-Frame-Options', value: 'DENY' }8 ]9}]2. Automated Pipeline Security: Run SAST (Static Application Security Testing via Semgrep or SonarQube), dependency vulnerability scanning (npm audit / Snyk), and DAST (Dynamic Application Security Testing via OWASP ZAP) on every pull request.
Quick reference
- Content Security Policy (CSP) restricts unauthorized JavaScript execution and external domain connections.
- HTTP Strict Transport Security (HSTS) forces browsers to use HTTPS exclusively for all requests.
- X-Frame-Options: DENY blocks clickjacking attacks by preventing iframe embedding.
- Dependency scanners (Snyk, Trivy) catch vulnerable npm/PyPI packages in CI build stages.
- SAST and DAST automated pipeline gates block PR merges when high-severity vulnerabilities are found.
Remember this
Configure strict CSP/HSTS security headers and integrate SAST/DAST automated scanners into CI/CD pipelines.
Key takeaway
To test OWASP mitigations, run an automated vulnerability scan using OWASP ZAP CLI against your local application (zap-cli quick-scan http://localhost:3000). Review and remediate identified security findings.
Related Articles
Explore this topic