Tested fixes for the weaknesses A01:2025 maps, in Express, Flask, Spring Boot, ASP.NET Core, Next.js, FastAPI, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a wrong fix and the regression tests.
Access-control failures expose other users’ data and privileged functions directly. The category has been first in the Top 10 since 2021, and in 2025 it also absorbed server-side request forgery.
- Deny by default, except for intentionally public resources, and enforce access control in trusted server-side code.
- Implement access control once and reuse it everywhere, checking ownership of each record rather than only whether a user is signed in.
- Disable directory listings, keep metadata and backup files out of web roots, and rate-limit API access to slow automated probing.
- Log access-control failures and alert on repeats; invalidate sessions at logout and keep tokens short-lived.
- For SSRF, allowlist outbound destinations and segment the network so the server cannot reach internal services it does not need.
Guides on this site
Enforce authorization for every object action
Authorize the authenticated subject, requested operation, and specific resource together; a valid login or unpredictable identifier is insufficient.
Authorize functions and fields as well as objects
Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test
Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
Protect cookie-authenticated actions against CSRF
Make the server distinguish an intended action from a request another site caused the browser to send.
Constrain server-side fetches to their intended destinations
Prevent untrusted URLs from turning a preview, import, or webhook feature into access to internal services.
Extract archives without escaping the destination
Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.
Redirect users only to destinations you control
Check every redirect target taken from a request, so attackers cannot borrow your domain for phishing, carry OAuth tokens off-site or steer a server-side fetcher through your redirects.
Review tenant boundaries before implementation
Trace tenant identity through requests, data stores, caches, jobs, and administration, then turn plausible isolation failures into tests.
Review trust boundaries in mobile and native clients
Protect local data and platform interactions while keeping server-side authorization independent of the client’s behavior.
Authenticate workloads and authorize their service actions
Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.
Keep retrieval inside the user’s data boundary
Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.
SCIM deprovisioning: make account disablement remove every usable authority
Connect SCIM resource updates to current sessions, tokens, group-derived permissions and background jobs, with explicit tenant mapping, CAEP revocation events and a measurable revocation contract.
Prevent shared-cache poisoning and private-response deception
Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.
Maintain an API inventory and prevent gateway bypass
Connect documented routes, deployed listeners and backend trust so retired or direct paths do not bypass the intended controls.
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Preserve framework security controls across the request lifecycle
Trace middleware, persistence and rendering so custom code does not bypass the protections supplied by the framework.
Review a code change through its trust boundaries
Turn a pull request into a small set of security claims that can be checked against the surrounding system and tests.
Defend OAuth and OIDC against redirect and token attacks
Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
Prevent file inclusion: LFI, RFI, dynamic imports and template names
Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.
Create temporary files safely: mkstemp, O_EXCL and private directories
Stop symlink, hardlink and pre-created-file attacks on the temporary files your code writes in shared directories such as /tmp: create each file atomically with O_EXCL and owner-only permissions through mkstemp or its equivalent in shell, Python, Java, Node.js, Go, .NET and Rust, keep related files in a private directory, and treat the Linux protected_* sysctls and systemd PrivateTmp as a backstop.
Secure design patterns: a catalogue for insecure-design (A06)
A catalogue of reusable secure-design patterns, grouped by concern, each with when to use it, a short example and the failure it prevents: choke-point authorization, capability tokens, parse-don't-validate, safe-by-default APIs, tenant scoping, fail-closed, idempotency, and more.
Practice
- CSRF lab: Protect an account change from a forged request · Browser lab
- Path traversal lab: Keep archive entries inside their extraction directory · Browser lab
- RAG access control lab: Stop a retriever from returning another tenant’s documents · Browser lab
- Excessive agency lab: Bind an agent’s action to the approved arguments · Browser lab
- IDOR lab: Repair an invoice authorization bug · Browser lab
- SSRF lab: Guard an outbound fetch against SSRF · Browser lab
- CORS policy lab: Grant CORS to the right origins only · Browser lab
- CSP builder lab: Build a strict Content-Security-Policy · Browser lab
- Path traversal lab: Serve an uploaded file without path traversal · Browser lab
- SSRF validation lab: Validate a fetch URL with ipaddress · Browser lab
- Open redirect lab: Return users to this site only · Browser lab
- File upload lab: Accept avatars without publishing pages · Browser lab
- Mass assignment lab: Update only the fields users may edit · Browser lab
- OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE · Browser lab
- NetworkPolicy lab: Lock down a shop namespace · Browser lab
- IAM trust policy lab: Evaluate a role trust policy against the confused deputy · Browser lab
- Secure a real HTTP API · Local project
- Keep extracted files inside their boundary · Local project
- Repair a real proxy and shared cache · Local project
- Enforce retrieval and tool boundaries across crashes · Local project
- Prove deprovisioning reaches sessions and queued work · Local project
- Keep an iOS app's storage, links and web bridge in bounds · Local project
- Repair an Android app's links, components, network policy and storage · Local project
- Convert untrusted documents in a locked-down container · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.