API Vulnerabilities and What to Do About Them
summary
Summarizes OWASP’s API Security Top 10 (2019) and maps each item to concrete failures: broken object‑level authorization (Parler leak), mass assignment (Harbor IO → admin rights), misconfiguration (Algolia snippets, Capital One chain), injection, rate‑limit abuse, excessive data exposure (Facebook Marketplace), improper asset management (legacy interfaces), and weak logging. Recommends static analysis, SCA tools (Black Duck, WhiteSource, Snyk), ZAP/DAST/IAST/RASP, AWS API Gateway, JWT + short tokens, Spring Security and CloudWatch. Cites surprising findings: 93% of scanned apps had defects and ~25% of breaches trace to apps.
AI-written summary · about
chapters (11)
- 0:00Start
- 8:26The Importance of Application Security
- 14:14ASPECTS OF SECURITY PRACTICE
- 19:52Other Key Security Organisations
- 24:52Broken Object-Level Authorisation
- 29:33Broken User Authentication
- 32:11Excessive Data Exposure
- 38:16Broken Function-Level Authorisation
- 47:29Security Misconfiguration
- 53:24Injection
- 55:51Improper Asset Management
related talks
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
25mOWASP Top 10 for APIs
26mOffensive API Penetration Testing
31mStandard Classification: API Security Top 10 - A Beginner's Guide to Mitigation
35mSecuring Your API: The OWASP Top 10
46mAPI Security – Divide & Conquer
51mHarmonizing the OWASP API and Application Top 10 Lists
30mBOLA, IDOR, MA, BFLA. Welcome to the OWASP API Top 10!