OWASP Top 10 for APIs
summary
OWASP API list focuses on authorization failings and real exploits: broken object level authorization (BOLA) is the most common issue, claimed present in every API tested over five years and responsible for an Uber full account takeover; excessive data exposure appears when back ends return PII and rely on front-end filtering (ThreeFun example); broken function‑level authorization and mass assignment permit privilege escalation (Shopify, New Relic); project is tied to OWASP, Checkmarx sponsorship, and Traceable.ai research.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:06Agenda
- 7:07The Bad News
- 9:22OWASP API Project
- 9:41Authz in APIs - The Challenge
- 11:20BOLA (Broken Object-Level Authorization)
- 13:02BOLA - Uber - Full Account Takeover
- 14:05Excessive Data Exposure
- 16:44BFLA (Broken Function Level Authorization)
- 17:48A5-BFLA - Example - Shopify
- 18:17A6-Mass Assignment "Create_user" code, traditional vs. modern
- 19:25A6-Example
related talks
30mBOLA, IDOR, MA, BFLA. Welcome to the OWASP API Top 10!
01h 29mAPI Vulnerabilities and What to Do About Them
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
26mOffensive API Penetration Testing
35mSecuring Your API: The OWASP Top 10
30mAPI Security - Divide & Conquer
31mOWASP API Security Project
46mAPI Security – Divide & Conquer