OWASP API Security Top 10

• · API1 Object-level authz: every endpoint returning/mutating a specific object verifies the requester owns or is permitted to access that exact object ID — on every call, not just list endpoints.
• · API2 Authentication: all API endpoints (including internal/partner APIs) require proper authentication; no endpoint relies on "security through obscurity" of an unguessable URL.
• · API3 Property-level authz: response payloads and accepted update fields are explicitly allowlisted per role — never serialize/deserialize entire internal models directly.
• · API4 Resource consumption: every endpoint has limits on rate, payload size, response size, pagination bounds, and execution cost (query complexity, timeouts) — unbounded is never the default.
• · API5 Function-level authz: privileged/administrative endpoints check role/permission explicitly, independent of object-level checks; never infer admin access from a client-supplied flag.

• · The ID-swap test: for every endpoint accepting an object ID, authenticate as user A, then request user B's object ID — does it return B's data? (API1)
• · The mass-assignment test: send an update request with an extra field the UI never exposes (isAdmin, role, balance) — does the server silently accept it? (API3)
• · The unbounded-list test: call a list/search endpoint with no pagination params, or a huge limit — does it return everything, unbounded? (API4)
• · The admin-endpoint-as-regular-user test: as a non-privileged user, directly call an admin-only endpoint URL — does it check role, or just check "is authenticated"? (API5)
• · The CORS wildcard check: grep for Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true — that combination is almost always a misconfiguration. (API8)

• · Ver anti-patrones específicos del dominio en el pack.

• [ ] Object-level authorization checked on every object-scoped endpoint call. (AP1)
• [ ] All endpoints require authentication except an explicit reviewed public allowlist. (AP2)
• [ ] Request/response fields explicitly allowlisted per role; no wholesale model binding. (AP3)
• [ ] Privileged endpoints check role independently of object-level checks. (AP5)
• [ ] Server-side requests from API input are allowlist-validated (SSRF). (AP7)
• [ ] Rate limits, payload size limits, and bounded pagination on every endpoint. (AP4)

• OWASP API Security Top 10:2023

Este pack cita las siguientes fuentes registradas en el índice bibliográfico:

• specOWASP API Security Top 10:2023OWASP Foundation