Getting API Security Right
summary
A study of 30 UK healthcare apps finds 77% hard-coded API keys and 7% with embedded usernames/passwords, and every tested API shows authorization flaws; common, concrete failures include BOLA (broken object level authorization), mass assignment and sensitive data exposure (e.g., password reset tokens leaking in JSON). Practical fixes: use DTOs to avoid auto-marshalling bugs, enforce application and per-user rate limits, publish an OpenAPI contract to drive tests and API firewalls, centralize authorization (or use Open Policy Agent), choose reference tokens vs short-lived JWTs appropriately, and compartmentalize services.
AI-written summary · about
chapters (18)
- 0:00Intro
- 2:17The cowboy years are over
- 7:24Enforce sensible limits
- 13:27The client is irrelevant
- 14:52Client controls are useless
- 18:34Sensitive Data Exposure
- 22:30Mass Assignment
- 25:03Test Your API
- 27:24API Firewalls
- 31:21Rest API
- 34:04Implement Function Level Authorization
- 36:42Auditability
- 42:28Cookies
- 44:21Tokens
- 47:48Understand your requirements
- 50:09Follow Jot Security
- 50:37What happens when API goes wrong
- 51:52Outro
