Common API security pitfalls

on YouTube ↗50m

" summary

HTTPS is mandatory and browsers should get HSTS for a year; always enforce TLS before any higher-level checks. Enforce rate limits per API key or account to stop brute force and data extraction. Check authorization on every resource to avoid insecure direct object references; use unpredictable IDs as a mitigation. Verify JWT signatures (don’t just decode), prefer public/private keys when sharing verification, and propagate identity to internal services for auditing. Be careful choosing cookies vs Authorization header, protect against CSRF, harden CORS, and use parameterized queries not just input validation.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 12:17SECURITY PITIALL Using insecure direct object references
3. 32:31SECURITY PITFALL Minimizing the impact of the transport mechanism
4. 44:48SECURITY PITIALL Insecure CORS configuration / Implementation
5. 48:32SECURITY PITFALL Relying on input validation

" related talks

• 53mCommon API Security PitfallsPhilippe De Ryck · NDC Security Oslo 2020
• 37mCommon REST API security pitfallsPhilippe De Ryck · OWASP BeNeLux Day 2017
• 50mCommon API Security PitfallsPhilippe De Ryck · NDC London 2020
• 08mAPI Security RisksSang Bui · TestFlix 2020
• 32mREST security essentialsAleksandar Radisavljević · Heapcon 2019
• 18mAPI Security Simplified: A 5-Pillar ApproachDavid Vazquez Cortizo · apidays London 2023
• 53mGetting API Security RightPhilippe De Ryck · NDC Security 2022
• 29mDefence in depthTobias Ahnoff, Martin Altenstedt · Jfokus 2021