OWASP Top 10 (2021) Compliance Checklist

A01:2021 – Broken Access Control

• Route-level access via middleware chain (JwtAuth, custom auth middleware)
• CORS middleware with configurable allow_origin
• Per-route authorization middleware
• Rate limiting per authenticated user (not just per-IP)

A02:2021 – Cryptographic Failures

• TLS via rustls 0.23 (TLS 1.2/1.3 only, no legacy protocols)
• HSTS header with configurable max-age and optional includeSubDomains/preload
• JWT signing and verification with HS256/RS256/ES256
• Secrets management module (secrets.rs): env/file/inline with no logging of values
• Password/secret rotation via env var or file re-read on restart
• Key rotation without restart (hot-reload)

A03:2021 – Injection

• SQL injection prevention: parameterized queries via sqlx (never string interpolation)
• JSON Schema validation rejects unexpected types
• XSS prevention: X-XSS-Protection: 0 (modern XSS prevention is via CSP)
• Content-Type sniffing prevention: X-Content-Type-Options: nosniff
• HTML sanitization if rendering user content
• Command injection prevention (no std::process::Command by default)

A04:2021 – Insecure Design

• Rate limiting: global (RateLimiter) and per-IP (IpRateLimiter)
• Circuit breaker pattern for external service calls
• Timeout middleware (504 Gateway Timeout)
• Graceful degradation via FallbackMiddleware
• Bulkhead pattern for concurrent request limiting
• Graceful shutdown (SIGTERM → drain → stop)
• Request size limits (max body size middleware)
• Request depth limits (e.g., max JSON nesting depth)

A05:2021 – Security Misconfiguration

• CORS with configurable origins, methods, headers
• Security headers: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Content-Security-Policy
• Non-root user in Docker image
• HEALTHCHECK in Dockerfile
• Automated security header check in CI
• Default-deny CORS (not * in production)

A06:2021 – Vulnerable and Outdated Components

• cargo-audit in CI (vulnerability scanning)
• cargo-deny in CI (license + advisory checks)
• Dependabot for automated dependency updates
• Supply chain: lockfile committed, deny.toml configured
• Trivy scanning in CI for Docker image vulnerabilities
• SBOM generation for Docker images

A07:2021 – Identification and Authentication Failures

• JWT authentication middleware with configurable validation
• OAuth2/OIDC support via custom middleware
• Session management (stateless JWT only; no server-side sessions)
• Multi-factor authentication support
• Password brute-force protection (per-IP rate limiter covers this partially)

A08:2021 – Software and Data Integrity Failures

• Supply chain: lockfile, cargo-deny, Dependabot
• CI/CD pipeline signing (sigstore/cosign)
• Package provenance (SLSA level 1+)
• Plugin signature verification (Phase 19)

A09:2021 – Security Logging and Monitoring Failures

• Structured logging (JSON or text format)
• Audit logging middleware (POST/PUT/DELETE/PATCH logging)
• Prometheus metrics including status codes and latency histograms
• Health check endpoints (/health, /live, /ready)
• Alerting: Slack, PagerDuty, Generic webhook
• OpenTelemetry tracing integration
• Centralized log aggregation documentation
• Alert on 5xx rate increase

A10:2021 – Server-Side Request Forgery (SSRF)

• URL validation middleware for outbound requests
• Allow-list of outbound hosts
• No user-controlled URL fetching by default

Legend

• Implemented
• Planned / not yet implemented
• Not applicable

Last updated: 2026-07-05