OWASP API Security Project
summary
OWASP API Top 10 history and methods are explicit: the project first compiles incidents by scraped bug bounty platforms then cross‑checks CWEs and community feedback, the 2023 update uses input from 22 contributors and finds concrete shifts — categories merged, dropped injection, new entries like SSRF, unrestricted sensitive business flows and resource exhaustion (denial of funds). Coverage includes tangible artifacts and exercises such as CRAPI and Juice Shop demos and guidance on what data vendors actually supplied and what still lacks validation.
AI-written summary · about
chapters (17)
- 0:00API Security Project intro
- 1:30Why API Top 10 exists
- 3:40Traditional vs modern app security
- 6:31Key API security challenges
- 8:41Top 10 as awareness docs
- 10:30First API Top 10 in 2019
- 12:43Community impact and vendor adoption
- 13:06Updating API Top 10 in 2023
- 15:13Changes 2019 to 2023
- 17:21Dropping injection adding new
- 18:02Why past versions matter
- 19:07Unrestricted sensitive business flows
- 21:18Unsafe consumption of third-party APIs
- 22:43Future of API security
- 24:32Q&A resource consumption
- 27:42Q&A financial DoS
- 29:12Q&A training resources
related talks
51mHarmonizing the OWASP API and Application Top 10 Lists
01h 02mApisecure, 14 & 15 March 2023 - Inon Shkedy, Co-Author of OWASP API Security Top 10.
47mOWASP Top 10
01h 29mAPI Vulnerabilities and What to Do About Them
25mOWASP Top 10 for APIs
27mAddressing OWASP API Security Top 10 starts at design time
50mThe How and Why of the OWASP Top Ten 2021
35mSecuring Your API: The OWASP Top 10