A06:2025 — Insecure Design

01 Insecure Design vs. Implementation Bugs

A secure implementation cannot fix an insecure design. Insecure design risks originate in design requirements, business workflows, and trust models:

Missing Anti-Automation / Rate Limiting: Endpoints designed without transaction rate limits, allowing coupon reuse, ticket scalping, or credit card testing.
Unbounded Resource Consumption: File upload or report generation services without quotas or memory limits allowing denial of service.
Implicit Trust Assumptions: Assuming backend microservices or internal APIs are inherently safe without internal token validation or mutual TLS.
Flawed State Machines: Workflows where step transitions (e.g. checkout → payment → order fulfillment) can be reordered or bypassed via parameter tampering.

02 Flawed Workflow Demonstration

Vulnerable Design: Price Calculation & Discount Loop

Business logic permits client-manipulated prices and unconstrained sequential coupon stacking.

vulnerable_order.phpPHP

// FLAWED DESIGN: Client passes item total and applied discount without server-side validation
function processOrder($userId, $cartItems, $clientTotal, $couponCode) {
    // Relies on client-computed total
    $total = $clientTotal;
    
    // Unbounded coupon validation: no check for prior usage per account
    if ($couponCode === 'SAVE20') {
        $total = $total * 0.80;
    }
    
    // Negative or zero total unchecked
    executeCharge($userId, $total);
}

03 Threat Modeling Patterns (STRIDE Analysis)

Threat Category	Design Risk	Mandatory Control
Spoofing	Unauthenticated service-to-service calls	mTLS or Signed Service Tokens
Tampering	Client-side pricing or transaction parameters	Authoritative Server Pricing Engine
Repudiation	Critical business actions lacking audit signatures	Immutable Audit Logs
Denial of Service	Unbounded report generation or batch operations	Async Job Queues & Worker Quotas

04 Secure Design Patterns

Robust Server-Authoritative State Engine

secure_order_engine.phpPHP 8+

class OrderCheckoutService {
    private PriceCatalog $catalog;
    private CouponRepository $couponRepo;
    private PaymentGateway $gateway;

    public function calculateFinalTotal(int $userId, array $itemIds, ?string $couponCode): int {
        // 1. Authoritative server lookup of unit prices (in cents)
        $subtotalCents = 0;
        foreach ($itemIds as $itemId) {
            $product = $this->catalog->findProductById($itemId);
            $subtotalCents += $product->getPriceCents();
        }

        // 2. Validate one-time coupon usage with database lock
        $discountCents = 0;
        if ($couponCode) {
            $coupon = $this->couponRepo->claimCouponForUser($couponCode, $userId);
            $discountCents = $coupon->calculateDiscount($subtotalCents);
        }

        $finalCents = max(0, $subtotalCents - $discountCents);
        return $finalCents;
    }
}

05 Verification & Compliance Checklist

Architecture Gate	Requirement	Status
Threat Modeling	All new major services undergo STRIDE threat modeling before coding.	Required
Rate Limiting	Distributed rate limiting on all public authentication & business endpoints.	Required
State Validation	State machine transitions verified by authoritative backend state.	Required