What Is API Security
API security is protecting the interfaces that applications use to talk to each other. As apps moved to APIs, so did the attackers, and most APIs are tested far less than the apps in front of them.
Why APIs are the growing attack surface
Modern apps are APIs with a thin interface on top. Every mobile app, every single page app, every integration runs on them. And because APIs expose data directly with identifiers in every request, one missed authorisation check is a breach.
The OWASP API Top 10
APIs have their own risk list, distinct from the web one. The single biggest is broken object level authorisation.
| Risk | What it does |
|---|---|
| BOLA | Access other users' objects by changing an ID |
| Broken auth | Weak token and session handling |
| Excessive data exposure | Returns more than the client needs |
| Mass assignment | Client sets fields it should not control |
| No rate limiting | Enables brute force and abuse |
The top risk is explained in full in BOLA explained.
How API testing differs from web testing
No UI to guide you, so documentation and captured traffic drive discovery. Authorisation flaws dominate over injection. Business logic is harder to infer.
Related
Frequently asked questions
What is API security?
Protecting the interfaces applications use to communicate, and testing them for flaws like broken authorisation.
What is the biggest API security risk?
Broken object level authorisation, where changing an identifier lets you access another user's data.
How is API testing different from web testing?
No UI to guide you, authorisation flaws dominate, and business logic is harder to infer.
Do random IDs fix API security?
No. They reduce discovery but do nothing about authorisation. IDs leak through search, logs and links.
How do I learn API security?
Learn how APIs work, then test the OWASP API Top 10 by hand, starting with broken object level authorisation.