API Security Top 10

As explained in Automating API Delivery

The OWASP API Security Top 10 is an industry awareness document describing and ranking prevalent security risks specific to APIs.

The OWASP API Security Top 10 is an industry-consensus awareness document that ranks critical security threats affecting web APIs. The 2023 version supports security review and design-time detection rather than replacing detailed vulnerability-mitigation guidance. section 10.2.1

The 2023 list includes these risks that can be detected partly by linting API definition files:

• API1:2023 — Broken Object Level Authorization section 10.2.1
• API2:2023 — Broken Authentication section 10.2.1
• API3:2023 — Broken Object Property Level Authorization section 10.2.1
• API4:2023 — Unrestricted Resource Consumption section 10.2.1
• API8:2023 — Security Misconfiguration section 10.2.1

Use the risks to shape API linting rules and CI/CD security checks at design time. Add runtime validation of traffic against OpenAPI definitions in an API gateway, and extend controls through DevSecOps practices and the API development life cycle. section 10.4

Figure 10.5 The Top 10 API security risks identified by OWASP

Browse the visual overview of the Top 10 API security risks identified by OWASP. section 10.2.1

How Automating API Delivery covers it

How deep it goes

Lists the 2023 risks and five lint-detectable examples, but defers detailed vulnerability mitigation to OWASP resources.

Examples

Uses five 2023 risks—authorization, authentication, resource consumption, and misconfiguration—as linting targets.

What you can do after

Apply via API linting and gateway validation to catch selected security issues before deployment and reduce backend-service exposure.

How it connects

Links API security with threat modeling, API linting, OpenAPI definitions, API gateways, runtime validation, and DevSecOps.

liveBookmanning.com

Read Automating API Delivery on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Secure APIsThe OWASP Top 10 API Security Risks is a published list of the most critical and prevalent security risks specific to application programming interfaces.

Compare how 2 books explain API Security Top 10 →

Related concepts

• API securityuses · API security is the protection of application programming interfaces, their functionality, and exposed data from unauthorized access, misuse, alteration, and disruption.

This explainer was generated by Manning's knowledge graph from the text of Automating API Delivery. The section links point to the parts of the book it draws on.