Common API Security Pitfalls
summary
Covers concrete API mistakes and fixes: rely never on the client for authorization, audit and centralize access policies to prevent broken object level access, always verify JWT signatures (don’t just decode), prefer asymmetric keys and design key rotation and JWKS discovery correctly, treat tokens as state with short lifetimes and refresh flows rather than long-lived JWT sessions, choose cookies when browsers must auto-send credentials (images, WebSockets), invest in XSS prevention instead of hiding tokens, validate input strictly and compartmentalize admin surfaces.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:48A10 Underprotected APIs
- 4:56OVER-EXPOSING API DATA
- 9:47LACK OF PROPER AUTHORIZATION
- 12:38FAILURE TO AUDIT THE AUTHORIZATION POLICY
- 20:36MISHANDLING CLIENT-SIDE SESSION DATA
- 26:53MISTAKING JWTS FOR SESSIONS
- 38:17LACK OF PROPER JWT KEY MANAGEMENT
- 38:49Cookie: ID=42
- 43:58UNDERESTIMATING THE IMPACT OF SESSION TRANSPORT
- 51:02FAILURE TO COMPARTMENTALIZE
related talks
50mCommon API Security Pitfalls
50mCommon API security pitfalls
37mCommon REST API security pitfalls
08mAPI Security Risks
18mAPI Security Simplified: A 5-Pillar Approach
17mAPI Security Simplified: Practical Tips & Tools
41mAPI Security 2026: How Not to End Up on Have I Been Pwned?
32mREST security essentials