API Security & OWASP Top 10 Hardening Checklist

API1:2023Critical(1/3 verified)

Broken Object Level Authorization (BOLA)

Endpoints expose object IDs where user authorization to that specific object is never verified on the server side.

🚨 Attack Vector Scenario:An attacker changes `/api/invoices/1042` to `/api/invoices/1043` and views proprietary billing data belonging to another tenant.

Hardening Verification Controls:

Use non-sequential, cryptographically random IDs (UUIDv4/NanoID) instead of auto-incrementing integers+10pt

Mandate user/tenant ownership check on every database read, update, and delete query+15pt

Centralize object authorization logic in reusable route middleware rather than ad-hoc controller code+10pt

Recommended Control: Snyk (Code SAST & API Analysis)Evaluate Solution →

API2:2023Critical(2/3 verified)

Broken Authentication

Authentication mechanisms are incorrectly implemented, permitting credential stuffing, token forgery, or password reset flaws.

🚨 Attack Vector Scenario:Adversary runs automated credential-stuffing against `/api/auth/login` without being throttled, or exploits weak JWT HMAC keys.

Hardening Verification Controls:

Enforce asymmetric RS256/EdDSA JWT signing with JWKS verification; reject 'none' algorithm+10pt

Apply strict sliding-window rate limiting on login, password-reset, and MFA challenge endpoints+10pt

Lock accounts or enforce exponential backoff after 5 consecutive failed MFA attempts+10pt

Recommended Control: Okta (Enterprise Identity & Auth)Evaluate Solution →

API3:2023High(1/2 verified)

Broken Object Property Level Authorization (BOPLA)

Lack of property validation allows attackers to manipulate sensitive properties via Mass Assignment or view hidden attributes.

🚨 Attack Vector Scenario:User submits `PATCH /api/user` with `{"role": "admin", "isVerified": true}` and the ORM blindly persists all payload fields.

Hardening Verification Controls:

Enforce strict schema validation (Zod, Pydantic, Joi) rejecting unauthorized payload fields+10pt

Filter outgoing response payloads through explicit Data Transfer Objects (DTOs) to prevent sensitive field leaks+10pt

Recommended Control: Snyk (AppSec Code Quality)Evaluate Solution →

API4:2023High(1/3 verified)

Unrestricted Resource Consumption

API lacks limits on execution timeouts, maximum memory, request payload sizes, or pagination records.

🚨 Attack Vector Scenario:Client sends query `?page_size=10000000` causing database full-table scan and Node.js process out-of-memory crash.

Hardening Verification Controls:

Hard cap API query pagination parameters (e.g. maximum 100 records per page)+10pt

Enforce maximum request body payload limits (e.g. 1MB for JSON, 10MB for multipart)+10pt

Implement strict gateway request timeout limits (maximum 10-30 seconds)+5pt

Recommended Control: Cloudflare (API Gateway & Throttling)Evaluate Solution →

API5:2023High(1/2 verified)

Broken Function Level Authorization (BFLA)

Administrative or sensitive functions are accessible by standard users due to missing role checks at the routing layer.

🚨 Attack Vector Scenario:A regular employee sends a request to `DELETE /api/v1/organizations/42/purge` and the server executes it because it only checked authentication.

Hardening Verification Controls:

Enforce explicit RBAC route guards on all administrative and privileged endpoints+10pt

Apply a strict default-deny authorization policy across all API routes+10pt

Recommended Control: Okta (Privileged Access Management)Evaluate Solution →

API6:2023Medium(0/2 verified)

Unrestricted Access to Sensitive Business Flows

Automated bots exploit business logic (purchasing limited inventory, scraping pricing, scalping coupons) without technical errors.

🚨 Attack Vector Scenario:Automated scalping script exhausts limited event tickets within 200 milliseconds of release.

Hardening Verification Controls:

Deploy bot detection / Cloudflare Turnstile challenges on sensitive checkout and redemption flows+10pt

Track business flow velocity per verified user (e.g. max 5 reservations per hour)+10pt

Recommended Control: Cloudflare (Bot Management & WAF)Evaluate Solution →

API7:2023Critical(0/2 verified)

Server-Side Request Forgery (SSRF)

API accepts user-supplied URLs to fetch remote resources without validating the target IP address against internal/private ranges.

🚨 Attack Vector Scenario:Adversary provides `http://169.254.169.254/latest/meta-data/iam/security-credentials/` as an avatar URL to steal AWS IAM keys.

Hardening Verification Controls:

Resolve hostnames and reject all RFC1918, RFC3927 (169.254), and loopback (127.0.0.1) IP addresses+15pt

Disable automatic HTTP redirect following in HTTP client libraries for user-provided URLs+10pt

Recommended Control: Wiz (Cloud Posture & IAM Security)Evaluate Solution →

API8:2023Medium(2/3 verified)

Security Misconfiguration

API servers reveal verbose error stack traces, have permissive CORS headers, or miss crucial security response headers.

🚨 Attack Vector Scenario:API returns 500 error containing PostgreSQL database passwords and file system paths in JSON output.

Hardening Verification Controls:

Strip stack traces and database errors from production API responses; return generic correlation IDs+10pt

Enforce strict CORS origin whitelisting (never reflect arbitrary Origin or return Access-Control-Allow-Origin: *)+10pt

Enforce HSTS, X-Content-Type-Options: nosniff, and Content-Security-Policy headers+10pt

Recommended Control: Tenable (Vulnerability Assessment)Evaluate Solution →

API9:2023Medium(0/2 verified)

Improper Inventory Management

Organizations expose deprecated API versions (v1, beta, staging) that lack security patches deployed to current versions.

🚨 Attack Vector Scenario:Attacker targets `/api/v1/auth` which still has an unpatched SQL injection bug fixed in `/api/v2`.

Hardening Verification Controls:

Formally decommission and block deprecated API versions with HTTP 410 Gone status codes+10pt

Maintain an automated, validated OpenAPI/Swagger contract synchronized in CI/CD pipelines+10pt

Recommended Control: Snyk (API Contract Governance)Evaluate Solution →

API10:2023High(0/2 verified)

Unsafe Consumption of APIs

Developers trust third-party vendor APIs more than user inputs, leading to downstream injection and bypasses.

🚨 Attack Vector Scenario:Adversary injects malicious SQL payload into a CRM vendor field which gets fetched and executed blindly by internal batch job.

Hardening Verification Controls:

Verify cryptographic HMAC-SHA256 signatures with timing-safe comparison on all incoming webhooks+10pt

Sanitize and validate payloads from third-party vendor APIs as strictly as public user input+10pt

Recommended Control: Bitwarden (API Secret Governance)Evaluate Solution →

API Hardening Posture Index

🛡️ OWASP API Security Top 10 (2023 Edition) Standards(10 categories)

Broken Object Level Authorization (BOLA)

Broken Authentication

Broken Object Property Level Authorization (BOPLA)

Unrestricted Resource Consumption

Broken Function Level Authorization (BFLA)

Unrestricted Access to Sensitive Business Flows

Server-Side Request Forgery (SSRF)

Security Misconfiguration

Improper Inventory Management

Unsafe Consumption of APIs