BOLA, IDOR, MA, BFLA. Welcome to the OWASP API Top 10!
summary
OWASP’s API Top 10 focuses on concrete failures: Broken Object Level Authorization lets an authenticated account enumerate IDs and retrieve roughly 2 million contracts from a customer portal; Excessive Data Exposure occurs when API responses include sensitive fields (latitude/longitude, photo URLs) despite UI privacy toggles. JWTs often leak inspectable claims, WAFs drop to ~20–30% effectiveness against API traffic, and common issues include missing per-request authorization checks, unbounded page sizes (defaults like 250 abused), broken function-level checks, mass assignment and injection in ad hoc microservices.
AI-written summary · about
chapters (21)
- 0:00Introduction and speaker background
- 1:25APIs changing security landscape
- 3:13History and evolution of APIs
- 5:46API microservices architecture
- 7:07OWASP API Top 10 vulnerabilities
- 9:58Why traditional WAFs fail on APIs
- 11:42Broken object level authorization
- 13:53Verizon API data exposure example
- 14:38USPS API authorization flaw
- 16:45Broken authentication in APIs
- 17:50JWT vulnerabilities and risks
- 18:31Excessive data exposure explained
- 20:43Client-side filtering risks
- 21:47API response inspection needs
- 22:07Resource and rate limiting
- 23:09Broken function level authorization
- 24:13Mass assignment vulnerabilities
- 25:40Security misconfiguration risks
- 26:22Injection attacks in APIs
- 27:27Improper asset management
- 28:49Legacy API version exposure
related talks
25mOWASP Top 10 for APIs
01h 29mAPI Vulnerabilities and What to Do About Them
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
35mSecuring Your API: The OWASP Top 10
51mHarmonizing the OWASP API and Application Top 10 Lists
27mAddressing OWASP API Security Top 10 starts at design time
26mOffensive API Penetration Testing
31mOWASP API Security Project