Insecure Design

OWASP A06:2025 — Insecure Design

What This Skill Does

Guides detection, analysis, and remediation of Insecure Design vulnerabilities — architecture-level failures where security controls are absent or structurally inadequate. Unlike implementation bugs, insecure design cannot be fixed by patching code alone; it requires redesigning the flow or adding missing control layers.

OWASP 2025 position: #6 (down from #4 in 2021, as threat modeling adoption has improved)
CWEs covered: 39 | Avg incidence: 1.86%
Key CWEs: CWE-434, CWE-269, CWE-362, CWE-799, CWE-602

Core Concepts

Design vs. Implementation

A design flaw requires adding a new control or refactoring the architecture, not just patching existing code.

Testing Checklist for FastAPI / Flask

1. Rate Limiting (CWE-799)

Verify that login, registration, password reset, and high-value transaction endpoints enforce rate limits.

FastAPI — SlowAPI:

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@app.post("/login")
@limiter.limit("5/minute")
async def login(request: Request, ...): ...

Flask — Flask-Limiter:

from flask_limiter import Limiter
limiter = Limiter(app, key_func=get_remote_address)

@app.route("/login", methods=["POST"])
@limiter.limit("5 per minute")
def login(): ...

Red flags to flag in review:

• Login, /register, /reset-password, /checkout routes with no rate-limiting decorator
• RATELIMIT_ENABLED = False or limiter initialized without being applied to sensitive routes
• Rate limits too permissive (e.g., 1000/minute on auth endpoints)

2. File Upload Security (CWE-434)

File uploads must be validated by content, not just extension, and stored outside the web root.

import magic  # python-magic

ALLOWED_MIME = {"image/jpeg", "image/png", "application/pdf"}
MAX_SIZE = 5 * 1024 * 1024  # 5 MB

@app.post("/upload")
async def upload(file: UploadFile):
    content = await file.read(MAX_SIZE + 1)
    if len(content) > MAX_SIZE:
        raise HTTPException(400, "File too large")
    mime = magic.from_buffer(content[:2048], mime=True)
    if mime not in ALLOWED_MIME:
        raise HTTPException(400, "Unsupported file type")
    # Store in /var/app/uploads/ — NOT inside static/ or public/
    safe_path = UPLOAD_DIR / secrets.token_hex(16)
    safe_path.write_bytes(content)

Red flags:

• Relying on file.content_type or extension alone (filename.endswith(".jpg"))
• Storing uploads in static/, public/, or any web-accessible path
• No file size cap
• Serving uploaded files via direct URL without authentication

3. Business Logic Flaws

Business logic flaws are application-specific — they exploit valid flows in unintended ways.

Common patterns to test:

FastAPI example — safe quantity handling:

class OrderItem(BaseModel):
    product_id: int
    quantity: int = Field(..., ge=1, le=100)  # enforced server-side

Red flags:

• Price, discount, or role fields accepted from client payload
• No idempotency key or duplicate-check on financial transactions
• Quantity or amount not bounded with ge=1 in Pydantic or equivalent

4. Tenant Isolation (CWE-269)

In multi-tenant apps, every DB query must scope to the authenticated tenant.

Pattern to enforce:

# UNSAFE — returns data across all tenants
def get_reports(db: Session):
    return db.query(Report).all()

# SAFE — scoped to current tenant
def get_reports(db: Session, current_user: User):
    return db.query(Report).filter(Report.tenant_id == current_user.tenant_id).all()

Red flags:

• Any db.query(Model).all() without tenant/user filter
• Admin-like queries reachable from user-facing endpoints
• Tenant ID passed in request body (must come from JWT/session, not user input)

5. Client-Side Enforcement of Server-Side Security (CWE-602)

Security enforced only in the browser is trivially bypassed via direct API calls.

Red flags:

• Authorization check only in JavaScript / frontend, not in the API route
• Hidden form fields controlling price, role, or access level
• Feature flags based on client-provided values (use JWT claims or server session)

# WRONG — trusting client-supplied role
@app.post("/admin/action")
async def admin_action(role: str = Body(...)):  # never do this
    if role == "admin":
        ...

# CORRECT — derive from authenticated token
@app.post("/admin/action")
async def admin_action(current_user: User = Depends(get_current_user)):
    if current_user.role != "admin":
        raise HTTPException(403)
    ...

6. Credential / Account Recovery Design

Insecure recovery flows are a design flaw, not an implementation bug.

Red flags:

• Knowledge-based security questions (mother's maiden name, pet name) — guessable from social media
• Password reset link not expiring within 15–60 minutes
• Reset token sent over HTTP or stored without hashing
• Account enumeration possible via reset flow ("no account found" vs. silent success)

Safe pattern:

# Generate short-lived, single-use, high-entropy token
token = secrets.token_urlsafe(32)
expiry = datetime.utcnow() + timedelta(minutes=30)
# Store hash of token, not the token itself
db_token = PasswordResetToken(
    user_id=user.id,
    token_hash=hashlib.sha256(token.encode()).hexdigest(),
    expires_at=expiry,
    used=False
)

Threat Modeling Guidance (STRIDE)

Use STRIDE to find design flaws before they reach code:

Remediation Priority Matrix

Reference Material

For deeper dives, see:

• references/cwe-details.md — full CWE descriptions and examples for all 39 CWEs in A06
• references/threat-modeling.md — STRIDE worksheet template for FastAPI/Flask apps

For related OWASP categories that overlap with design issues:

• A01 Broken Access Control — when the design grants too much access by default
• A07 Authentication Failures — when auth flow design is the root cause
• A10 Mishandling of Exceptional Conditions — when error recovery design fails closed