SEVEN things about API security
summary
Covers concrete failures and fixes: shows SSRF via parser ambiguity where URL parsers and libcurl disagree and internal services become reachable; reproduces a timing- and brute‑force password reset using Burp Suite intruder brute‑force demo against a 4‑digit token; replaces guessable tokens with signed JWT reset tokens to prevent tampering; explains broken function/object/property authorization and prescribes pulling logic into a single policy or service like centralized policy/OPA and using DTOs to stop excessive data exposure.
AI-written summary · about
chapters (6)
- 0:00API security fundamentals
- 6:04Server-side request forgery risks
- 20:10Broken authentication case study
- 42:06Authorization flaws and access control
- 55:04Excessive data exposure
- 59:55Key takeaways
