Common API Security Pitfalls

on YouTube ↗50m

" summary

APIs commonly leak full JSON or images because endpoints trust identifiers instead of enforcing ownership checks, causing broken object level access control. Systems misuse JWTs by decoding without verifying signatures and treating tokens as long‑lived sessions so revocation is impossible — JWT ≠ session. Key management mistakes (HMAC secrets shared across services instead of per‑service public/private keys) and storing tokens in localStorage amplify risk; enforce a centralized authorization policy, compartmentalize APIs, and prioritize XSS prevention.

AI-written summary · about

" chapters (15)

1. 0:00Start
2. 0:21Common Api Security Pitfalls
3. 5:13Authorization Issues
4. 5:59Unsecure Direct Object References
5. 7:03Broken Object Level Access Control
6. 8:36Explicit Authorization Checks
7. 9:12Lack of Proper Authorization
8. 13:24Authorization
9. 17:13Protect the Data
10. 21:24Token-Based Authentication
11. 34:29Cookies
12. 34:58Using an Authorization Header
13. 37:00Authorization Checks
14. 44:42Input Validation
15. 47:36Compartmentalization

" related talks

• 53mCommon API Security PitfallsPhilippe De Ryck · NDC Security Oslo 2020
• 50mCommon API security pitfallsPhilippe De Ryck · Devoxx Belgium 2017
• 37mCommon REST API security pitfallsPhilippe De Ryck · OWASP BeNeLux Day 2017
• 53mGetting API Security RightPhilippe De Ryck · NDC Security 2022
• 15mJWTs And Why They SuckRory M · BSides London 2021
• 31mStandard Classification: API Security Top 10 - A Beginner's Guide to MitigationI. Mauny · OWASP 20th Anniversary 2021
• 41mAPI Security 2026: How Not to End Up on Have I Been Pwned?Mickaël Barroux · Devoxx France 2026
• 08mAPI Security RisksSang Bui · TestFlix 2020