API Security

3.

OWASP API Security Top 10

3.1.

API1 Broken Object Level Authorization

3.1.1.

Understanding BOLA

3.1.1.1.

Authorization Bypass Scenarios

3.1.1.2.

Object Reference Vulnerabilities

3.1.1.3.

Impact Assessment

3.1.2.

Common Exploitation Techniques

3.1.2.1.

Direct Object References

3.1.2.2.

Parameter Manipulation

3.1.2.3.

3.1.3.

Detection Methods

3.1.3.1.

Code Review Techniques

3.1.3.2.

Testing Approaches

3.1.3.3.

Automated Scanning

3.1.4.

Prevention Strategies

3.1.4.1.

Object-Level Access Controls

3.1.4.2.

Authorization Validation

3.1.4.3.

Secure Object References

3.2.

API2 Broken Authentication

3.2.1.

Authentication Weaknesses

3.2.1.1.

Weak Credential Policies

3.2.1.2.

Insecure Storage

3.2.1.3.

Poor Session Management

3.2.2.

Common Vulnerabilities

3.2.2.1.

Credential Stuffing

3.2.2.2.

Brute Force Attacks

3.2.2.3.

Session Fixation

3.2.2.4.

3.2.3.

JWT-Specific Issues

3.2.3.1.

Algorithm Confusion

3.2.3.2.

Weak Signatures

3.2.3.3.

3.2.3.4.

Improper Validation

3.2.4.

Mitigation Approaches

3.2.4.1.

Strong Authentication Mechanisms

3.2.4.2.

Multi-Factor Authentication

3.2.4.3.

Secure Token Management

3.2.4.4.

Session Security

3.3.

API3 Broken Object Property Level Authorization

3.3.1.

Excessive Data Exposure

3.3.1.1.

Over-Sharing Information

3.3.1.2.

Sensitive Field Leakage

3.3.1.3.

Response Filtering Failures

3.3.2.

Mass Assignment Vulnerabilities

3.3.2.1.

Unintended Property Updates

3.3.2.2.

Parameter Binding Issues

3.3.2.3.

Model Overposting

3.3.3.

Prevention Techniques

3.3.3.1.

Schema-Based Validation

3.3.3.2.

Property Whitelisting

3.3.3.3.

Response Filtering

3.3.3.4.

Input Sanitization

3.4.

API4 Unrestricted Resource Consumption

3.4.1.

Resource Exhaustion Attacks

3.4.1.1.

CPU Consumption

3.4.1.2.

Memory Exhaustion

3.4.1.3.

Storage Depletion

3.4.1.4.

Network Bandwidth

3.4.2.

Denial of Service Scenarios

3.4.2.1.

Application-Level DoS

3.4.2.2.

Distributed Attacks

3.4.2.3.

Slowloris Attacks

3.4.3.

Protection Mechanisms

3.4.3.1.

3.4.3.2.

Resource Quotas

3.4.3.3.

Request Size Limits

3.4.3.4.

Connection Throttling

3.5.

API5 Broken Function Level Authorization

3.5.1.

Function Access Control Flaws

3.5.1.1.

Privilege Escalation

3.5.1.2.

Administrative Function Access

3.5.1.3.

3.5.2.

Common Attack Patterns

3.5.2.1.

HTTP Method Manipulation

3.5.2.2.

Endpoint Discovery

3.5.2.3.

Parameter Tampering

3.5.3.

Prevention Methods

3.5.3.1.

Function-Level Checks

3.5.3.2.

Role-Based Controls

3.5.3.3.

Method Restrictions

3.5.3.4.

Access Matrix Implementation

3.6.

API6 Unrestricted Access to Sensitive Business Flows

3.6.1.

Business Logic Exploitation

3.6.1.1.

Workflow Circumvention

3.6.1.2.

Process Manipulation

3.6.1.3.

State Transition Attacks

3.6.2.

Common Attack Scenarios

3.6.2.1.

Purchase Flow Manipulation

3.6.2.2.

Account Creation Abuse

3.6.2.3.

Voting System Exploitation

3.6.3.

Protection Strategies

3.6.3.1.

3.6.3.2.

Anomaly Detection

3.6.3.3.

Business Rule Enforcement

3.6.3.4.

Rate Limiting by Function

3.7.

API7 Server Side Request Forgery

3.7.1.

SSRF Attack Mechanics

3.7.1.1.

Internal Network Access

3.7.1.2.

Cloud Metadata Exploitation

3.7.1.3.

3.7.2.

Impact Scenarios

3.7.2.1.

Internal Service Access

3.7.2.2.

Credential Harvesting

3.7.2.3.

Network Reconnaissance

3.7.3.

Prevention Techniques

3.7.3.1.

Input Validation

3.7.3.2.

3.7.3.3.

Network Segmentation

3.7.3.4.

Outbound Request Controls

3.8.

API8 Security Misconfiguration

3.8.1.

Common Misconfigurations

3.8.1.1.

Default Credentials

3.8.1.2.

Unnecessary Services

3.8.1.3.

Verbose Error Messages

3.8.1.4.

Missing Security Headers

3.8.2.

CORS Misconfigurations

3.8.2.1.

Overly Permissive Origins

3.8.2.2.

Credential Exposure

3.8.2.3.

Preflight Bypass

3.8.3.

Hardening Practices

3.8.3.1.

Secure Defaults

3.8.3.2.

Configuration Management

3.8.3.3.

Regular Security Reviews

3.8.3.4.

Automated Compliance Checks

3.9.

API9 Improper Inventory Management

3.9.1.

API Discovery Challenges

3.9.1.1.

3.9.1.2.

Undocumented Endpoints

3.9.1.3.

Legacy Versions

3.9.2.

Inventory Management Issues

3.9.2.1.

Incomplete Documentation

3.9.2.2.

Version Control Problems

3.9.2.3.

Lifecycle Management

3.9.3.

Management Solutions

3.9.3.1.

Automated Discovery

3.9.3.2.

Documentation Standards

3.9.3.3.

Version Deprecation

3.9.3.4.

3.10.

API10 Unsafe Consumption of APIs

3.10.1.

Third-Party API Risks

3.10.1.1.

Data Validation Issues

3.10.1.2.

Trust Assumptions

3.10.1.3.

Dependency Vulnerabilities

3.10.2.

Integration Security Issues

3.10.2.1.

Injection from Upstream

3.10.2.2.

3.10.2.3.

Service Dependencies

3.10.3.

Safe Consumption Practices

3.10.3.1.

Input Validation

3.10.3.2.

Data Sanitization

3.10.3.3.

Service Hardening

3.10.3.4.

Dependency Management

Previous

2. Fundamental Security Principles

Go to top

Next

4. Authentication Mechanisms