Insecure Design

OWASP A06:2025 — Insecure Design

What This Skill Does

Guides detection, analysis, and remediation of Insecure Design vulnerabilities — architecture-level failures where security controls are absent or structurally inadequate. Unlike implementation bugs, insecure design cannot be fixed by patching code alone; it requires redesigning the flow or adding missing control layers.

OWASP 2025 position: #6 (down from #4 in 2021, as threat modeling adoption has improved) CWEs covered: 39 | Avg incidence: 1.86% Key CWEs: CWE-434, CWE-269, CWE-362, CWE-799, CWE-602

---

Core Concepts

Design vs. Implementation

| Insecure Design (A06) | Implementation Bug (other categories) | |---|---| | Rate limiting never architected into login flow | Rate limiter present but misconfigured | | File upload stored in web root by design | Upload handler missing extension check | | No tenant isolation in multi-tenant DB schema | Query missing WHERE clause | | Business logic allows negative quantities | Missing server-side input validation |

A design flaw requires adding a new control or refactoring the architecture, not just patching existing code.

---

Testing Checklist for FastAPI / Flask

1. Rate Limiting (CWE-799)

Verify that login, registration, password reset, and high-value transaction endpoints enforce rate limits.

FastAPI — SlowAPI:

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@app.post("/login")
@limiter.limit("5/minute")
async def login(request: Request, ...): ...

Flask — Flask-Limiter:

from flask_limiter import Limiter
limiter = Limiter(app, key_func=get_remote_address)

@app.route("/login", methods=["POST"])
@limiter.limit("5 per minute")
def login(): ...

Red flags to flag in review:

• Login, /register, /reset-password, /checkout routes with no rate-limiting decorator
• RATELIMIT_ENABLED = False or limiter initialized without being applied to sensitive routes
• Rate limits too permissive (e.g., 1000/minute on auth endpoints)

---

2. File Upload Security (CWE-434)

File uploads must be validated by content, not just extension, and stored outside the web root.

import magic  # python-magic

ALLOWED_MIME = {"image/jpeg", "image/png", "application/pdf"}
MAX_SIZE = 5 * 1024 * 1024  # 5 MB

@app.post("/upload")
async def upload(file: UploadFile):
    content = await file.read(MAX_SIZE + 1)
    if len(content) > MAX_SIZE:
        raise HTTPException(400, "File too large")
    mime = magic.from_buffer(content[:2048], mime=True)
    if mime not in ALLOWED_MIME:
        raise HTTPException(400, "Unsupported file type")
    # Store in /var/app/uploads/ — NOT inside static/ or public/
    safe_path = UPLOAD_DIR / secrets.token_hex(16)
    safe_path.write_bytes(content)

Red flags:

• Relying on file.content_type or extension alone (filename.endswith(".jpg"))
• Storing uploads in static/, public/, or any web-accessible path
• No file size cap
• Serving uploaded files via direct URL without authentication

---

3. Business Logic Flaws

Business logic flaws are application-specific — they exploit valid flows in unintended ways.

Common patterns to test:

| Scenario | Test | |---|---| | Negative quantity in cart | POST with quantity: -1, verify order total doesn't go negative | | Price manipulation | POST with a price field — verify server ignores client-supplied price | | Concurrent purchase race | Parallel requests to buy last item — verify only one succeeds | | Booking system abuse | Book same slot twice in parallel | | Coupon reuse | Apply same coupon twice before first transaction commits |

FastAPI example — safe quantity handling:

class OrderItem(BaseModel):
    product_id: int
    quantity: int = Field(..., ge=1, le=100)  # enforced server-side

Red flags:

• Price, discount, or role fields accepted from client payload
• No idempotency key or duplicate-check on financial transactions
• Quantity or amount not bounded with ge=1 in Pydantic or equivalent

---

4. Tenant Isolation (CWE-269)

In multi-tenant apps, every DB query must scope to the authenticated tenant.

Pattern to enforce:

# UNSAFE — returns data across all tenants
def get_reports(db: Session):
    return db.query(Report).all()

# SAFE — scoped to current tenant
def get_reports(db: Session, current_user: User):
    return db.query(Report).filter(Report.tenant_id == current_user.tenant_id).all()

Red flags:

• Any db.query(Model).all() without tenant/user filter
• Admin-like queries reachable from user-facing endpoints
• Tenant ID passed in request body (must come from JWT/session, not user input)

---

5. Client-Side Enforcement of Server-Side Security (CWE-602)

Security enforced only in the browser is trivially bypassed via direct API calls.

Red flags:

• Authorization check only in JavaScript / frontend, not in the API route
• Hidden form fields controlling price, role, or access level
• Feature flags based on client-provided values (use JWT claims or server session)

# WRONG — trusting client-supplied role
@app.post("/admin/action")
async def admin_action(role: str = Body(...)):  # never do this
    if role == "admin":
        ...

# CORRECT — derive from authenticated token
@app.post("/admin/action")
async def admin_action(current_user: User = Depends(get_current_user)):
    if current_user.role != "admin":
        raise HTTPException(403)
    ...

---

6. Credential / Account Recovery Design

Insecure recovery flows are a design flaw, not an implementation bug.

Red flags:

• Knowledge-based security questions (mother's maiden name, pet name) — guessable from social media
• Password reset link not expiring within 15–60 minutes
• Reset token sent over HTTP or stored without hashing
• Account enumeration possible via reset flow ("no account found" vs. silent success)

Safe pattern:

# Generate short-lived, single-use, high-entropy token
token = secrets.token_urlsafe(32)
expiry = datetime.utcnow() + timedelta(minutes=30)
# Store hash of token, not the token itself
db_token = PasswordResetToken(
    user_id=user.id,
    token_hash=hashlib.sha256(token.encode()).hexdigest(),
    expires_at=expiry,
    used=False
)

---

Threat Modeling Guidance (STRIDE)

Use STRIDE to find design flaws before they reach code:

| Threat | Applies to | Example in FastAPI/Flask | |---|---|---| | Spoofing | Auth flows | Predictable session tokens, missing MFA | | Tampering | Data in transit/storage | Missing HMAC on signed data, writable uploads | | Repudiation | Audit logs | Missing request logging on financial actions | | Information Disclosure | Error messages, API docs | /docs open in prod, stack traces in 500 | | Denial of Service | Rate limiting, resource use | No request size cap, missing rate limiter | | Elevation of Privilege | Authorization design | Client-supplied role, missing tenant scope |

---

Remediation Priority Matrix

| Finding | Severity | Fix complexity | |---|---|---| | No rate limiting on auth/payment endpoints | High | Low — add SlowAPI/Flask-Limiter | | File uploads stored in web root | High | Medium — move storage path, add serving layer | | Client-supplied price/role fields | Critical | Low — remove field from request model | | Missing tenant scope on DB queries | Critical | Medium — audit all queries | | Knowledge-based security questions | Medium | High — redesign recovery flow | | Race condition on inventory/booking | Medium | High — add DB-level locking or idempotency |

---

Reference Material

For deeper dives, see:

• references/cwe-details.md — full CWE descriptions and examples for all 39 CWEs in A06
• references/threat-modeling.md — STRIDE worksheet template for FastAPI/Flask apps

For related OWASP categories that overlap with design issues:

• A01 Broken Access Control — when the design grants too much access by default
• A07 Authentication Failures — when auth flow design is the root cause
• A10 Mishandling of Exceptional Conditions — when error recovery design fails closed

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: scholarly360
• Source: scholarly360/owasp-top10-web-skills
• License: MIT

Install and usage instructions live in the source repository linked above.