The Future of API Security
summary
API security focuses on concrete failures: Express.js demo shows validation bypass where sending an array instead of a string turns a parameter into an XSS/injection vector and the exploit executes, proving inadequate input checks. Real-world supply-chain attacks like event-stream (used by millions) and SolarWinds show third-party packages can carry malicious code. Defenses listed include OAuth, MFA, rate limits, logging, asset inventory and just-in-time access to remove standing privileges.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:10What is OWASP
- 6:27Security and supply chain
- 6:56Malware distributions
- 9:09API vs REST
- 9:56API Parameters
- 10:20Security Breaches
- 10:42Recommendations
- 17:37API Security Checklist
- 18:18Questions
related talks
01h 29mAPI Vulnerabilities and What to Do About Them
26mAPI and Application Security - The Future
31mAPI security
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
25mThe New API Vulnerability Frontier
22mLayered Approach of API Security Strategies and its Business Impact
47mThe Rise of API Security: It’s 10pm—Do You Know Where Your APIs are?
22mHow to Fortify Your API Against Multi-Vector Threats