API security

Enforce authorization for every object action

Authorize the authenticated subject, requested operation, and specific resource together; a valid login or unpredictable identifier is insufficient.

Development, Testing · Developers

Verify webhook deliveries before acting

Verify the provider’s signature over the correct bytes, then apply replay, authorization, and idempotency controls before a business action.

Design, Development · Developers, AppSec engineers

Authorize functions and fields as well as objects

Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.

Development, Testing · Developers, AppSec engineers

Secure WebRTC signaling, TURN relays and media servers

WebRTC encrypts media, but signaling decides whose keys you trust and TURN relays wherever it is allowed. Authorize every signaling message, mint short-lived TURN credentials, deny internal addresses and harden media servers.

Design, Development · Developers, Platform engineers and SREs

Choose and evaluate application security testing tools

What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.

Testing, Maintenance, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

Consume third-party APIs safely (OWASP API10:2023)

Treat every upstream and third-party API response as untrusted input: validate it against a schema, set connect and read timeouts, cap the response size, refuse to follow redirects blindly, keep TLS verification on, and scope the credentials you hold for each provider.

Design, Development · Developers, AppSec engineers

Case study: First American's EaglePro document exposure (2019)

How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.

Development, Testing, Maintenance, Security program · Developers, AppSec engineers, Security leaders

Bound API work, not just request counts

Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.

Development, Maintenance · Developers, Platform engineers and SREs

Maintain an API inventory and prevent gateway bypass

Connect documented routes, deployed listeners and backend trust so retired or direct paths do not bypass the intended controls.

Development, Maintenance · Developers, Platform engineers and SREs

Apply security limits to GraphQL, WebSocket and gRPC operations

Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.

Development, Maintenance · Developers, Platform engineers and SREs

Keep HTTP services up under application-layer DDoS

Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.

Development, Maintenance · Platform engineers and SREs

Authorization models: RBAC, ABAC, ReBAC and policy as code you can test

Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.

Design, Development · Developers

Defend JWTs against forgery, confusion and replay

Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.

Development · Developers

IDOR lab: Repair an invoice authorization bug

Bob can retrieve Alice’s invoice by changing the URL. You own the endpoint’s permission check. Reproduce the leak, patch the function below, and prove that Alice can still read her invoice.

Webhook signature and replay lab: Repair a webhook handler that pays twice

Your handler rejects some genuine deliveries and records replayed payments twice. Fix the function below, then test valid, changed, replayed, and concurrent deliveries.

JWT verification lab: Verify a JWT before trusting it

An API decodes the JWT it receives and trusts the claims without checking the signature or the algorithm, so an attacker can forge an admin token with alg "none" or sign one with a key the API never issued. Repair the verifier so it confirms the algorithm and signature first, then the claims.

Mass assignment lab: Update only the fields users may edit

PATCH /me merges the whole request body into the stored user, so adding "role": "admin" turns a member into an administrator. Change only the fields a user may edit on their own profile.

Missing object-level authorization (IDOR and BOLA)

Missing object-level authorization (IDOR, called BOLA in the OWASP API list) happens when an API checks that a caller is signed in and then loads whatever invoice, order or file the request names, so changing an ID in the URL, the query string or a bulk export returns someone else's data.

Unbounded resource consumption

Unbounded resource consumption happens when a request can make the server spend without limit: an unbounded request body, a batch or page size the caller chooses, or an endpoint with no rate limit, so one client exhausts memory, CPU or the connection pool.

Missing authentication for a critical function

Missing authentication for a critical function happens when a route that returns user or internal data runs without a verified caller: the endpoint has no authentication, or it reads identity from the request itself (a userId parameter, an X-Authenticated-User header an upstream proxy was supposed to set) and so authenticates nothing.

Mass assignment (over-posting)

Mass assignment, also called over-posting or autobinding, happens when an endpoint copies every field the request body names onto a stored object.