OWASP API Security Top 10 Risks - Ultimate Guide

Explore the CIA triad and the fundamentals of authentication and authorization, including MFA, RBAC, and ABAC, to secure applications and manage access to API resources.

Learn to design secure APIs with RBAC and ABAC, balancing simplicity and fine-grained control through hybrid approaches, while enforcing least privilege and ongoing policy management.

Discover the OWASP organization, its mission, and the origins of the OWASP Top 10 and API Top 10, and learn how to identify and mitigate common web app security risks.

Compare the 2023 and 2019 OWASP api top 10, detailing renamed, redefined, and newly added risks like unrestricted access to sensitive business flows, server-side request forgery, and unsafe api consumption.

Demonstrate API vulnerabilities in a vulnerable online bookstore, with customer, seller, and admin roles, covering registration, login, search, orders, inventory management, and an open API spec for OWASP top 10.

Identify how broken object level authorization exposes user data by failing to enforce access checks on object identifiers in APIs, enabling IDOR through predictable resource locations.

Explore how broken object level authorization, or IDOR, across API endpoints enables unauthorized data access by simple URL or post request modifications, causing data breaches and account takeovers.

Protect apis from broken object level authorization by enforcing server-side, object-level access checks, validating ownership, using indirect references, and centralized access control with abac and rbac.

The practical demo shows how broken object level authorization (BOLA) lets a malicious seller alter another publisher's book stock via api calls using a valid jwt.

Understand broken authentication as a core OWASP API security risk, where weak passwords, lack of multi-factor authentication, improper session management, and insecure credential storage enable attackers to access.

Understand how broken authentication enables brute force, credential stuffing, and session hijacking, leading to access to sensitive data, unauthorized transactions, and lost trust with legal and reputational damage.

Learn mitigation strategies to prevent broken authentication, including enforcing strong passwords, multi-factor authentication, OAuth and OpenID Connect, secure session management, encrypted credential storage, account lockouts, CAPTCHAs, and user education.

Demonstrates a brute force attack on a bookstore login API, showing how weak passwords enable credential compromise and underscoring the need for strong password policies and multi-factor authentication.

Explain broken object property level authorization, the third OWASP API security top 10 risk, and how improper property-level access enables mass assignment and exposure of sensitive fields.

Explore how broken object property level authorization enables unauthorized access and modification of sensitive properties, causing privilege escalation, data breaches, and financial loss in real-world APIs.

Implement property-based access control and role-based restrictions to enforce property-level authorizations. Validate input data, apply output filtering, and follow least privilege to protect API data.

Demonstrate privilege escalation through broken object property level authorization by updating a user’s role via API calls after obtaining a JWT, revealing the need for granular access control.

Unrestricted resource consumption is a critical OWASP API Security top 10 risk that allows API clients to exhaust server resources, causing performance degradation or denial of service.

Unrestricted resource consumption threatens API availability, enabling easy exploitation and difficult detection, with amplification risks across connected systems and potential severe business disruption under heavy load.

Implement rate limiting and operation caps to prevent abuse, return HTTP 429 on limit breaches, and optimize resources with pooling, timeouts, quotas, and caching.

Demonstrate how missing rate limiting and pagination on the book search and forgot password endpoints can cause unrestricted resource consumption and denial of service.

Demonstrates how a publicly accessible forgot password endpoint can be abused by automated requests. Highlights lack of authentication and rate limiting, and the need for captcha to prevent resource exhaustion.

Examine broken function level authorization (bflA) and its distinction from bola, focusing on missing authorization checks and improper role based access control (rbac) enabling unauthorized actions.

Expose how broken function level authorization enables unauthorized data modification, data loss, corruption, and privilege escalation, as shown by the Texas Department of Insurance breach and the Optus breach.

Enforce strong role-based access control with clear roles at every endpoint, ensuring only authorized users access functions. Use centralized authorization checks and least-privilege access across server and app logic.

Examine how broken function level authorization enables a non-admin user to access admin endpoints, view all users, and delete accounts via unauthorized API calls, highlighting lacked server side rbac validation.

Identify how unrestricted access to sensitive business flows enables attackers to exploit purchasing and reservations without proper access controls or rate limiting, causing revenue loss and service disruption.

Allowing unrestricted access to sensitive business flows enables attackers to abuse critical operations like financial transactions and resource reservations, enabling automated attacks with high, hard-to-detect impact on revenue.

Identify sensitive business flows and implement rate limiting, CAPTCHA verification, and behavioral analysis to detect anomalies and prevent automated abuse of APIs.