Common REST API security pitfalls
summary
Checklist style evaluation says whether to watch: the session names specific failures and fixes — missing authorization on ID-based endpoints, client-side sessions trusting tamperable data, common JWT mistakes like using decode instead of verify and signing with shared secrets instead of RSA, transport errors (no HTTPS, missing HSTS), CSRF vs CORS tradeoffs and cookie vs authorization header pitfalls, and concrete examples such as an Angular interceptor that leaks tokens to third parties. Expect about ten actionable pitfalls with code-level examples and mitigation steps.
AI-written summary · about
chapters (31)
- 0:00Intro
- 0:27Demo
- 2:23About me
- 3:24API
- 3:37HTTP
- 4:04Guidelines
- 4:37HTTPStrict Transport Security
- 5:21Warming Up
- 5:39Application Layer
- 6:40Endpoints
- 7:21State Changing Operations
- 7:33Missing Authorization
- 8:10Session Information
- 10:41Clientside Session Data
- 10:55JSON Web Token
- 12:16Decode Functions
- 13:00Token Misuse
- 13:28JSON Web Token Rabbit Hole
- 18:53Cookies
- 21:23Authorization Header
- 23:01Attachment to outgoing requests
- 24:08Default solutions
- 24:35Crosssite request forgery
- 28:00Transparent token
- 29:45Crossorigin resource sharing
- 31:32Custom headers
- 32:12Cookies for API
- 32:37Input validation
- 33:51Input validation best practices
- 35:12Over or under estimating input validation
- 36:00Build secure stuff
