API Productivity by Design
summary
Claims that API architecture antipatterns create security debt and slow sprints, backed by a real bug where a crafted parameter returns session tokens leak via parameter allowing full tenant takeover; finds a client with over 50 vulnerable endpoints, an unwieldy role ACL file and inconsistent proxy vs backend checks that are fail-open. Shows fixes that work: global middleware and DB-layer tenant filtering, CI Semgrep rules to catch new endpoints, and migrating integer IDs to GUIDs to reduce severity.
AI-written summary · about
chapters (11)
- 0:00API security reviews
- 3:08Authorization flaws in APIs
- 5:14Authorization tasks in SaaS APIs
- 7:02Manual authorization problems
- 10:29Inconsistent authorization in APIs
- 14:04Access control list pitfalls
- 16:33Versioned APIs security bypasses
- 18:40Token leak bug root cause
- 21:54Self-documenting secure APIs
- 23:39Refactoring vulnerable endpoints
- 25:24Quick wins for API security
