Skip to content
JustAPI

OWASP Top 10 Compliance

A01: Broken Access Control

Section titled “A01: Broken Access Control”
  • ✅ Route-level access via middleware chain (JwtAuth, custom auth)
  • ✅ CORS middleware with configurable allow_origin
  • Per-route authorization middleware
  • Rate limiting per authenticated user

A02: Cryptographic Failures

Section titled “A02: Cryptographic Failures”
  • ✅ TLS via rustls (TLS 1.2/1.3 only, no legacy protocols)
  • ✅ HSTS header with configurable max-age
  • ✅ JWT signing with HS256/RS256/ES256
  • ✅ Secrets management (env/file/inline, no logging)
  • Key rotation without restart (hot-reload)

A03: Injection

Section titled “A03: Injection”
  • ✅ SQL injection prevention: parameterized queries via sqlx
  • ✅ JSON Schema validation rejects unexpected types
  • ✅ XSS prevention via CSP headers
  • ✅ Content-Type sniffing prevention: X-Content-Type-Options: nosniff
  • HTML sanitization for user-rendered content

A04: Insecure Design

Section titled “A04: Insecure Design”
  • ✅ Rate limiting: global and per-IP
  • ✅ Circuit breaker pattern
  • ✅ Timeout middleware (504 Gateway Timeout)
  • ✅ Graceful degradation via FallbackMiddleware
  • ✅ Bulkhead pattern for concurrent request limiting
  • ✅ Graceful shutdown (SIGTERM → drain → stop)
  • Request body depth limits

A05: Security Misconfiguration

Section titled “A05: Security Misconfiguration”
  • ✅ CORS with configurable origins, methods, headers
  • ✅ Security headers (X-Content-Type-Options, X-Frame-Options, HSTS, CSP)
  • ✅ Non-root user in Docker image
  • ✅ HEALTHCHECK in Dockerfile
  • Automated security header check in CI

A06: Vulnerable and Outdated Components

Section titled “A06: Vulnerable and Outdated Components”
  • ✅ cargo-audit in CI (vulnerability scanning)
  • ✅ cargo-deny in CI (license + advisory checks)
  • ✅ Dependabot for automated dependency updates
  • ✅ Supply chain: lockfile committed, deny.toml configured
  • Trivy scanning for Docker image vulnerabilities

A07: Identification and Authentication Failures

Section titled “A07: Identification and Authentication Failures”
  • ✅ JWT authentication middleware
  • ✅ OAuth2/OIDC support via custom middleware
  • Multi-factor authentication support

A08: Software and Data Integrity Failures

Section titled “A08: Software and Data Integrity Failures”
  • ✅ Supply chain: lockfile, cargo-deny, Dependabot
  • CI/CD pipeline signing (sigstore/cosign)
  • Plugin signature verification

A09: Security Logging and Monitoring Failures

Section titled “A09: Security Logging and Monitoring Failures”
  • ✅ Structured logging (JSON or text format)
  • ✅ Audit logging middleware
  • ✅ Prometheus metrics with latency histograms
  • ✅ Health check endpoints (/health, /live, /ready)
  • ✅ Alerting: Slack, PagerDuty, Generic webhook
  • ✅ OpenTelemetry tracing integration

A10: Server-Side Request Forgery (SSRF)

Section titled “A10: Server-Side Request Forgery (SSRF)”
  • URL validation middleware for outbound requests
  • Allow-list of outbound hosts

Legend

Section titled “Legend”
  • ✅ Implemented
  • Planned / not yet implemented

See Also

Section titled “See Also”