SEVEN things about API security
summary
Explains four OWASP API issues with concrete fixes: an SSRF bypass via @@-style URLs that fooled Dropbox-style hostname checks and curl, fixed by parsing once or decomposing the URL; a live Burp Suite demo showing timing-based username enumeration and a 4‑digit reset code brute force leading to account takeover, fixed by rate limits and signing the reset token with a JSON Web Token; and pervasive data leaks and authorization holes solved by using explicit DTOs and a centralized policy engine with unit tests.
AI-written summary · about
chapters (6)
- 0:00API security importance
- 5:43Server side request forgery risks
- 16:32Broken authentication cases
- 34:49Authorization flaws
- 45:39Broken object property authorization
- 55:14Summary and workshop
