OWASP A03 & A04: Understanding Software Supply Chain and Cryptographic Failures
By Samyuktha Introduction Some categories in the OWASP Top 10 are about what's broken in your own code. A03 and A04 are about something a little different — whether you can trust what your application depends on, and whether sensitive data is actually protected wherever it lives or travels. This post covers what I learned about both categories, and how I applied that thinking to an authorized web…
The OWASP A03 and A04 categories address software supply chain and cryptographic failures, respectively. A03 focuses on vulnerabilities introduced through third-party dependencies, insecure build pipelines, and unverified components. A04 covers inadequate protection of sensitive information, including improper encryption, insecure data transmission, and unprotected storage.
The author examines an authorized web application to illustrate these concepts in practice. For A03, the author reviewed client-side resources, including JavaScript files, CSS, JavaScript and asset files, external runtime resources like Google Fonts, and external references like social media and app-store links. No obvious third-party imports or compromised components were identified, so no A03 finding was confirmed.
For A04, the author assessed the application's adherence to HTTPS, checked for sensitive data in URLs, Local Storage and Session Storage, and cookie attributes. The application redirected successfully to HTTPS, no sensitive information was found in URLs, and no authentication data appeared in Local or Session Storage. However, the author could not fully assess authentication cookie attributes as the production backend was not fully built out.
Additionally, the author could not test real login and dashboard functionality due to the demo status of the available resources. No A04 cryptographic failures were confirmed within the accessible functionality.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
