---
# === IDENTITY ===
id: software/security/owasp-top-10/2026
canonical_question: "What is the OWASP Top 10 checklist with code examples?"
aliases:
  - "OWASP Top 10 2021 list"
  - "OWASP Top 10 vulnerabilities"
  - "OWASP Top 10 cheat sheet"
  - "web application security checklist"
  - "OWASP broken access control fix"
  - "OWASP injection prevention"
  - "OWASP Top 10 code examples"
  - "OWASP Top 10 secure coding"
  - "OWASP Top 10 2021 vs 2017"
  - "web security vulnerabilities checklist"
entity_type: software_reference
domain: software > security > owasp_top_10
region: global
jurisdiction: global
temporal_scope: 2021-2026

# === VERIFICATION ===
last_verified: 2026-02-24
confidence: 0.92
freshness: annual
version: 1.0
first_published: 2026-02-24

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: stable
  last_breaking_change: "OWASP Top 10 2021 release (Sep 2021) — 3 new categories, 4 renamed, major reordering"
  next_review: 2026-08-23
  change_sensitivity: medium

# === CONSTRAINTS ===
constraints:
  - "The OWASP Top 10 is a risk-awareness document, not a compliance standard -- passing all 10 does not mean your application is secure"
  - "The current official version is OWASP Top 10:2021 (released September 2021); a 2025 draft exists but is not yet ratified"
  - "OWASP Top 10 focuses on web applications only -- mobile, API, and cloud have separate OWASP projects (Mobile Top 10, API Top 10, Cloud-Native Top 10)"
  - "Automated scanners (ZAP, Burp) only detect a subset of the Top 10 -- A04 Insecure Design and A08 Integrity Failures require manual review"
  - "Never rely solely on client-side validation for any OWASP category -- all security controls must be enforced server-side"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "User needs OWASP API Security Top 10 (for REST/GraphQL APIs specifically)"
    use_instead: "OWASP API Security Top 10 (2023) -- separate project with different categories"
  - condition: "User needs OWASP Mobile Top 10 (for iOS/Android apps)"
    use_instead: "OWASP Mobile Top 10 (2024) -- covers mobile-specific risks like insecure storage, binary protections"
  - condition: "User needs a compliance framework (PCI DSS, SOC 2, ISO 27001)"
    use_instead: "OWASP Top 10 is not a compliance standard; map to PCI DSS Requirement 6 or ISO 27001 Annex A.14 instead"

# === AGENT HINTS ===
inputs_needed:
  - key: tech_stack
    question: "What is your primary web framework/language?"
    type: choice
    options: ["Node.js/Express", "Python/Django/Flask", "Java/Spring", "PHP/Laravel", ".NET/ASP.NET", "Go", "Ruby/Rails"]
  - key: threat_priority
    question: "Which vulnerability category are you most concerned about?"
    type: choice
    options: ["Broken Access Control (A01)", "Injection (A03)", "Authentication (A07)", "All of them (general audit)"]
  - key: tooling
    question: "Do you already use any security scanning tools?"
    type: choice
    options: ["None yet", "OWASP ZAP", "Burp Suite", "Snyk/Dependabot", "SonarQube/Semgrep"]

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/software/security/owasp-top-10/2026"
suggested_citation: "Source: knowledgelib.io -- AI Knowledge Library (verified 2026-02-24)"

# === BUY LINKS ===
buy_links: []

# === RELATED UNITS ===
related_kos:
  related_to:
    - id: software/patterns/jwt-implementation/2026
      label: "JWT Implementation Patterns"
    - id: software/patterns/session-management/2026
      label: "Session Management Patterns"
    - id: software/patterns/rbac-implementation/2026
      label: "RBAC Implementation"
    - id: software/patterns/api-key-management/2026
      label: "API Key Management"
    - id: software/debugging/ssl-tls-certificate-errors/2026
      label: "SSL/TLS Certificate Errors"
    - id: software/debugging/browser-cors-errors/2026
      label: "Browser CORS Errors"
  solves:
    - id: software/security/sql-injection-prevention/2026
      label: "SQL Injection Prevention"
    - id: software/security/xss-prevention/2026
      label: "XSS Prevention"

# === SOURCES (7 authoritative sources) ===
sources:
  - id: src1
    title: "OWASP Top 10:2021"
    author: OWASP Foundation
    url: https://owasp.org/Top10/
    type: official_docs
    published: 2021-09-24
    reliability: authoritative
  - id: src2
    title: "OWASP Cheat Sheet Series — Top 10 Index"
    author: OWASP Foundation
    url: https://cheatsheetseries.owasp.org/IndexTopTen.html
    type: official_docs
    published: 2024-01-15
    reliability: authoritative
  - id: src3
    title: "PortSwigger Web Security Academy — All Topics"
    author: PortSwigger
    url: https://portswigger.net/web-security/all-topics
    type: community_resource
    published: 2025-06-01
    reliability: high
  - id: src4
    title: "ZAPping the OWASP Top 10 (2021)"
    author: OWASP ZAP Project
    url: https://www.zaproxy.org/docs/guides/zapping-the-top-10-2021/
    type: official_docs
    published: 2023-03-15
    reliability: high
  - id: src5
    title: "OWASP Top 10: 2021 vs. 2017 — Comparative Analysis"
    author: Mrutunjaya Senapati
    url: https://medium.com/@mrutunjayasenapati0/owasp-top-10-2021-vs-2017-a-comparative-analysis-70990e5570f8
    type: technical_blog
    published: 2023-08-20
    reliability: moderate_high
  - id: src6
    title: "OWASP Top 10 2021: What's New"
    author: Outpost24
    url: https://outpost24.com/blog/owasp-top-10-2021-what-is-new/
    type: technical_blog
    published: 2022-04-12
    reliability: moderate_high
  - id: src7
    title: "OWASP Cheat Code Series"
    author: OWASP Foundation
    url: https://owasp.org/www-project-cheat-code-series/
    type: official_docs
    published: 2024-06-01
    reliability: high
---

# OWASP Top 10 (2021) — Web Application Security Checklist with Code Examples

## TL;DR

- **Bottom line**: A01 Broken Access Control and A03 Injection are the most common web application vulnerabilities; the 2021 list introduced 3 new categories (Insecure Design, Software Integrity Failures, SSRF) and promoted access control flaws to #1.
- **Key tool/command**: `docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://your-app.com`
- **Watch out for**: Treating OWASP Top 10 as a compliance checklist rather than a risk-awareness document -- passing all 10 does not guarantee a secure application.
- **Works with**: Any web application stack (Node.js, Python, Java, .NET, Go, PHP, Ruby); language-specific mitigations vary but principles are universal.

## Constraints
<!-- Agents: read this section before recommending any action from this unit.
     These are hard constraints that must not be violated. -->

- The OWASP Top 10 is a risk-awareness document, not a compliance standard -- passing all 10 does not mean your application is secure
- The current official version is OWASP Top 10:2021 (released September 2021); a 2025 draft exists but is not yet ratified
- OWASP Top 10 focuses on web applications only -- mobile, API, and cloud have separate OWASP projects
- Automated scanners (ZAP, Burp) only detect a subset of the Top 10 -- A04 Insecure Design and A08 Integrity Failures require manual review
- Never rely solely on client-side validation for any OWASP category -- all security controls must be enforced server-side

## Quick Reference

| # | Vulnerability | Risk | Vulnerable Code | Secure Code |
|---|---|---|---|---|
| A01 | Broken Access Control | Critical | `if (user.role === 'admin') // client-side check only` | `authorize(req.user, resource, 'write') // server-side RBAC per request` |
| A02 | Cryptographic Failures | High | `md5(password)` or `http://` for sensitive data | `bcrypt.hash(password, 12)` + TLS 1.2+ everywhere |
| A03 | Injection (SQL, XSS, CMD) | Critical | `db.query("SELECT * FROM users WHERE id=" + req.params.id)` | `db.query("SELECT * FROM users WHERE id=$1", [req.params.id])` |
| A04 | Insecure Design | High | No rate limiting on login; no threat model | Threat model in design phase; rate limit + account lockout |
| A05 | Security Misconfiguration | High | Default admin credentials; verbose error pages in prod | Harden configs; disable stack traces; remove default accounts |
| A06 | Vulnerable Components | High | `"lodash": "^3.0.0"` (unpinned, known CVE) | `npm audit fix`; pin versions; Dependabot/Renovate enabled |
| A07 | Auth Failures | High | `session.maxAge = null` (no expiry) | Short-lived sessions + MFA + bcrypt + constant-time compare |
| A08 | Software/Data Integrity | High | `<script src="https://cdn.example.com/lib.js">` (no SRI) | `<script src="..." integrity="sha384-..." crossorigin>` |
| A09 | Logging Failures | Medium | No logging of failed logins or access denials | Structured logging of auth events with alerting on anomalies |
| A10 | SSRF | High | `fetch(req.body.url)` (unvalidated user URL) | Allowlist URLs; block private IP ranges; use DNS resolution checks |

## Decision Tree

```
START
|-- Is the app handling user authentication/sessions?
|   |-- YES --> Check A07 (Auth Failures) + A01 (Broken Access Control) first
|   +-- NO (static site / read-only API) --> Skip A07, focus on A03 + A05
|
|-- Does the app accept user input (forms, APIs, file uploads)?
|   |-- YES --> Prioritize A03 (Injection) + A01 (Access Control)
|   +-- NO --> Focus on A02 (Crypto) + A05 (Misconfiguration)
|
|-- Does the app fetch external resources or URLs?
|   |-- YES --> Check A10 (SSRF) + A08 (Integrity Failures)
|   +-- NO --> Skip A10
|
|-- Does the app use third-party packages/libraries?
|   |-- YES --> Check A06 (Vulnerable Components) -- run `npm audit` / `pip audit`
|   +-- NO --> Skip A06
|
+-- DEFAULT --> Run full OWASP ZAP baseline scan + manual code review
```

## Step-by-Step Guide

### 1. Run an automated baseline scan

Start with OWASP ZAP to identify low-hanging fruit across all 10 categories. [src4]

```bash
# Run ZAP baseline scan against your application
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://your-app.com \
  -r report.html
```

**Verify**: Open `report.html` in a browser -- expected: HTML report with findings categorized by risk level (High/Medium/Low/Informational).

### 2. Audit access control (A01)

Review every endpoint for authorization checks. Ensure deny-by-default at the middleware level. [src1]

```javascript
// Express.js: middleware-level authorization
function authorize(requiredRole) {
  return (req, res, next) => {
    if (!req.user || !req.user.roles.includes(requiredRole)) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    next();
  };
}
app.delete('/api/users/:id', authorize('admin'), deleteUser);
```

**Verify**: `curl -X DELETE https://your-app.com/api/users/1 -H "Authorization: Bearer <non-admin-token>"` -- expected: `403 Forbidden`.

### 3. Eliminate injection vectors (A03)

Replace all string-concatenated queries with parameterized queries. Run SAST to find remaining instances. [src2]

```bash
# Find potential SQL injection in Node.js codebase
grep -rn "query\s*(" --include="*.js" --include="*.ts" | grep -v "\$\|?\|@"
# Any matches using string concatenation need parameterization
```

**Verify**: `npx semgrep --config=p/owasp-top-ten .` -- expected: no critical injection findings.

### 4. Scan dependencies for known vulnerabilities (A06)

```bash
# Node.js
npm audit --audit-level=high

# Python
pip install pip-audit && pip-audit

# Java/Maven
mvn org.owasp:dependency-check-maven:check
```

**Verify**: `npm audit` -- expected: `found 0 vulnerabilities` (or only low-severity dev dependencies).

### 5. Review cryptographic practices (A02)

Ensure passwords use bcrypt/scrypt/argon2, all traffic uses TLS 1.2+, and no sensitive data is stored in plaintext. [src1]

```bash
# Check TLS configuration
nmap --script ssl-enum-ciphers -p 443 your-app.com
# Verify no weak ciphers (RC4, DES, 3DES) appear in output
```

**Verify**: Output shows only TLS 1.2+ with AES-GCM or ChaCha20 cipher suites.

### 6. Implement security logging and monitoring (A09)

Configure structured logging for all authentication events, access denials, and input validation failures. Set up alerting for anomalous patterns. [src2]

```javascript
// Structured security event logging
const securityLog = {
  event: 'AUTH_FAILURE',
  timestamp: new Date().toISOString(),
  ip: req.ip,
  userAgent: req.headers['user-agent'],
  username: req.body.username, // never log passwords
  reason: 'invalid_credentials'
};
logger.warn(securityLog);
```

**Verify**: `grep "AUTH_FAILURE" /var/log/app.log | tail -5` -- expected: structured JSON entries for each failed login attempt.

## Code Examples
<!-- Keep inline examples <=15 lines. For longer scripts, extract to scripts/ subdirectory
     and link: "Full script: [name.ext](scripts/name.ext) (N lines)" -->

### Node.js/Express: Vulnerable vs Secure for Top 5

#### A01 Broken Access Control

```javascript
// VULNERABLE: Only checks ownership on the client
app.get('/api/documents/:id', async (req, res) => {
  const doc = await db.query('SELECT * FROM docs WHERE id=$1', [req.params.id]);
  res.json(doc.rows[0]); // No ownership check -- any user can read any doc
});

// SECURE: Server-side ownership verification
app.get('/api/documents/:id', authenticate, async (req, res) => {
  const doc = await db.query(
    'SELECT * FROM docs WHERE id=$1 AND owner_id=$2',
    [req.params.id, req.user.id]       // Filter by authenticated user
  );
  if (!doc.rows[0]) return res.status(404).json({ error: 'Not found' });
  res.json(doc.rows[0]);
});
```

#### A03 Injection (SQL)

```javascript
// VULNERABLE: String concatenation in SQL query
app.get('/api/users', async (req, res) => {
  const result = await db.query(
    `SELECT * FROM users WHERE name = '${req.query.name}'`  // SQL injection
  );
  res.json(result.rows);
});

// SECURE: Parameterized query
app.get('/api/users', async (req, res) => {
  const result = await db.query(
    'SELECT * FROM users WHERE name = $1',   // Parameterized
    [req.query.name]
  );
  res.json(result.rows);
});
```

#### A07 Authentication Failures

```javascript
// VULNERABLE: Weak session config
app.use(session({
  secret: 'keyboard cat',          // Weak secret
  cookie: { secure: false },       // No HTTPS requirement
  resave: true                     // No expiry
}));

// SECURE: Hardened session config
app.use(session({
  secret: process.env.SESSION_SECRET,     // Strong, env-sourced secret
  cookie: {
    secure: true,                          // HTTPS only
    httpOnly: true,                        // No JS access
    sameSite: 'strict',                    // CSRF protection
    maxAge: 1800000                        // 30 min expiry
  },
  resave: false,
  saveUninitialized: false
}));
```

### Python/Flask: Vulnerable vs Secure for Top 5

#### A01 Broken Access Control

```python
# VULNERABLE: No authorization check
@app.route('/admin/users', methods=['DELETE'])
def delete_user():
    user_id = request.args.get('id')
    db.execute('DELETE FROM users WHERE id = %s', (user_id,))
    return jsonify(success=True)

# SECURE: Role-based authorization decorator
from functools import wraps
def require_role(role):
    def decorator(f):
        @wraps(f)
        def wrapped(*args, **kwargs):
            if not current_user.has_role(role):
                abort(403)
            return f(*args, **kwargs)
        return wrapped
    return decorator

@app.route('/admin/users', methods=['DELETE'])
@login_required
@require_role('admin')
def delete_user():
    user_id = request.args.get('id')
    db.execute('DELETE FROM users WHERE id = %s', (user_id,))
    return jsonify(success=True)
```

#### A03 Injection (SQL)

```python
# VULNERABLE: f-string in SQL
@app.route('/search')
def search():
    name = request.args.get('q')
    cursor.execute(f"SELECT * FROM products WHERE name LIKE '%{name}%'")
    return jsonify(cursor.fetchall())

# SECURE: Parameterized query
@app.route('/search')
def search():
    name = request.args.get('q')
    cursor.execute(
        "SELECT * FROM products WHERE name LIKE %s",
        (f'%{name}%',)  # Parameter binding
    )
    return jsonify(cursor.fetchall())
```

#### A10 SSRF Prevention

```python
# VULNERABLE: Unvalidated URL fetch
@app.route('/fetch-url')
def fetch_url():
    url = request.args.get('url')
    response = requests.get(url)  # Can access internal services!
    return response.text

# SECURE: URL allowlisting + IP validation
import ipaddress, urllib.parse

ALLOWED_HOSTS = {'api.example.com', 'cdn.example.com'}

@app.route('/fetch-url')
def fetch_url():
    url = request.args.get('url')
    parsed = urllib.parse.urlparse(url)
    if parsed.hostname not in ALLOWED_HOSTS:
        abort(400, 'Host not allowed')
    if parsed.scheme not in ('https',):
        abort(400, 'HTTPS required')
    # Additional: resolve DNS and verify not private IP
    import socket
    ip = socket.gethostbyname(parsed.hostname)
    if ipaddress.ip_address(ip).is_private:
        abort(400, 'Private IP not allowed')
    response = requests.get(url, timeout=5)
    return response.text
```

## Anti-Patterns

### Wrong: Client-side access control

```javascript
// BAD -- authorization check in the browser
if (localStorage.getItem('role') === 'admin') {
  showAdminPanel();   // User can edit localStorage to bypass
}
```

### Correct: Server-side access control

```javascript
// GOOD -- server enforces authorization on every request
app.get('/admin', authorize('admin'), (req, res) => {
  res.json(getAdminData()); // Server rejects non-admin tokens
});
```

### Wrong: Storing passwords with MD5/SHA

```python
# BAD -- fast hash, trivially reversible with rainbow tables
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()
```

### Correct: Using bcrypt with cost factor

```python
# GOOD -- slow adaptive hash, salt built-in
import bcrypt
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))
```

### Wrong: Trusting user-supplied URLs without validation

```javascript
// BAD -- allows SSRF to internal services
const response = await fetch(req.body.url);
```

### Correct: URL allowlisting with DNS verification

```javascript
// GOOD -- validate scheme, host, and resolved IP
const url = new URL(req.body.url);
if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');
if (url.protocol !== 'https:') throw new Error('HTTPS required');
const { address } = await dns.resolve4(url.hostname);
if (isPrivateIP(address)) throw new Error('Private IP blocked');
```

### Wrong: Inline scripts without integrity checks

```html
<!-- BAD -- no integrity verification, CDN compromise = app compromise -->
<script src="https://cdn.example.com/lib.js"></script>
```

### Correct: Subresource Integrity (SRI)

```html
<!-- GOOD -- browser verifies hash before executing -->
<script src="https://cdn.example.com/lib.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8w"
  crossorigin="anonymous"></script>
```

## Common Pitfalls

- **Confusing OWASP Top 10 with a compliance standard**: Organizations "pass" an OWASP assessment but miss application-specific risks not in the Top 10. Fix: Use OWASP Top 10 as a starting point, then perform application-specific threat modeling. [src1]
- **Only running automated scans**: ZAP and Burp find A03 (Injection) and A05 (Misconfiguration) well, but miss A04 (Insecure Design) entirely. Fix: Combine automated scanning with manual code review and architectural threat modeling. [src4]
- **Ignoring A06 (Vulnerable Components) in CI/CD**: Teams add `npm audit` but ignore warnings or set `--production` flag incorrectly. Fix: `npm audit --audit-level=high && exit 1` in CI pipeline to fail builds on high-severity findings. [src2]
- **Logging passwords and tokens (A09)**: Security logging accidentally includes sensitive data in log entries. Fix: Explicitly exclude `password`, `token`, `cookie` fields from log serialization. [src2]
- **Using allowlist bypass with DNS rebinding (A10 SSRF)**: Validating hostname against allowlist but not the resolved IP allows DNS rebinding attacks. Fix: Resolve DNS first, validate the IP, then connect using the resolved IP. [src3]
- **Applying OWASP Top 10 for web apps to APIs**: The web Top 10 misses API-specific risks like BOLA and mass assignment. Fix: Use OWASP API Security Top 10 (2023) for REST/GraphQL APIs. [src1]

## Diagnostic Commands

```bash
# Run OWASP ZAP baseline scan (Docker)
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://your-app.com

# Scan Node.js dependencies for known CVEs (A06)
npm audit --audit-level=high

# Scan Python dependencies (A06)
pip-audit --strict

# Run Semgrep with OWASP rules (A03 Injection + more)
npx semgrep --config=p/owasp-top-ten .

# Scan Docker images for vulnerabilities (A06)
docker scout cves your-image:latest

# Check TLS configuration (A02)
nmap --script ssl-enum-ciphers -p 443 your-app.com

# Scan with Snyk (A06 + A03)
npx snyk test --severity-threshold=high

# Check HTTP security headers (A05)
curl -sI https://your-app.com | grep -iE "strict-transport|content-security|x-frame|x-content-type"
```

## Version History & Compatibility

| Version | Status | Breaking Changes | Migration Notes |
|---|---|---|---|
| OWASP Top 10:2021 | Current | 3 new categories (A04 Insecure Design, A08 Integrity Failures, A10 SSRF); 4 renamed; XSS merged into A03 Injection | Map 2017 A4 (XXE) to 2021 A05; A8 (Insecure Deserialization) to A08; A10 (Insufficient Logging) to A09 |
| OWASP Top 10:2017 | Superseded | Introduced Insecure Deserialization (A8) and Insufficient Logging (A10) | XSS was standalone (A7); now merged into Injection (A03) in 2021 |
| OWASP Top 10:2013 | Legacy | — | First to include Using Components with Known Vulnerabilities |
| OWASP Top 10:2025 (Draft) | Draft | Proposed updates reflect AI/LLM risks | Not ratified -- do not use as authoritative reference yet |

### Key 2017 to 2021 Changes

- **A01**: Broken Access Control rose from #5 to #1 (94% of apps tested had some form of broken access control) [src1]
- **A02**: Sensitive Data Exposure renamed to Cryptographic Failures (cause-focused, not symptom-focused) [src6]
- **A03**: Injection dropped from #1 to #3; now includes Cross-Site Scripting (XSS) [src5]
- **A04**: Insecure Design is NEW -- covers architectural flaws and missing threat models [src1]
- **A07**: Broken Authentication dropped from #2 to #7; renamed to Identification and Authentication Failures [src5]
- **A08**: Software and Data Integrity Failures is NEW -- includes Insecure Deserialization from 2017 [src6]
- **A10**: SSRF is NEW -- added based on industry survey as a "forward-looking" risk [src1]

## When to Use / When Not to Use

| Use When | Don't Use When | Use Instead |
|---|---|---|
| Starting a new web application security program | Building mobile-only applications | OWASP Mobile Top 10 (2024) |
| Training developers on common web vulnerabilities | Securing REST/GraphQL APIs specifically | OWASP API Security Top 10 (2023) |
| Performing security code reviews | Meeting specific compliance requirements | PCI DSS Req 6, ISO 27001 Annex A.14, NIST 800-53 |
| Setting up automated security scanning in CI/CD | Evaluating cloud infrastructure security | OWASP Cloud-Native Application Security Top 10 |
| Threat modeling during design phase | Performing network-level penetration testing | OWASP Testing Guide + network security frameworks |

## Important Caveats

- The OWASP Top 10 is updated roughly every 3-4 years; the 2021 edition is current as of February 2026 but a 2025 draft is under community review. Always check owasp.org for the latest official version.
- Vulnerability prevalence varies by industry and tech stack. Financial services see more A01 (Access Control) issues while e-commerce sees more A03 (Injection). Prioritize based on your specific risk profile.
- The Top 10 categories overlap significantly: an SQL injection (A03) often exploits broken access control (A01) and may be enabled by security misconfiguration (A05). Treat categories as perspectives on risk, not independent checklists.
- Code examples in this unit use Node.js/Express and Python/Flask for illustration. The same principles apply to all server-side frameworks, but the specific APIs and middleware differ. Consult the OWASP Cheat Sheet Series for framework-specific guidance.

## Related Units
<!-- Generated from related_kos frontmatter -->

- [JWT Implementation Patterns](/software/patterns/jwt-implementation/2026)
- [Session Management Patterns](/software/patterns/session-management/2026)
- [RBAC Implementation](/software/patterns/rbac-implementation/2026)
- [API Key Management](/software/patterns/api-key-management/2026)
- [SSL/TLS Certificate Errors](/software/debugging/ssl-tls-certificate-errors/2026)
- [Browser CORS Errors](/software/debugging/browser-cors-errors/2026)