The three axes of API security provide a practical way to analyze vulnerabilities across design, implementation, and infrastructure. Each axis exposes different weaknesses and consequences. section 1.1
Analyze an API through three complementary questions:
- Design: Does the API expose unbounded strings, predictable integer identifiers, or missing pagination that enable large-payload, resource-discovery, or denial-of-service attacks? section 1.1
- Implementation: Does the code validate incoming and outgoing payloads, use data transfer objects, parameterize database queries, and restrict dangerous input such as SSRF targets? section 1.1
- Infrastructure: Do authentication, network topology, segmentation, firewalls, gateways, storage, and computing resources limit exposure and internal service access? section 1.1
One attack, three review angles
An API accepts input that can trigger SSRF. Review the implementation for input sanitization, inspect whether internal service calls are authenticated, and assess whether sensitive services are isolated on separate networks. section 1.1
Figure 1.3 To analyze attack vectors, we look at the three axes of API security: design, implementation, and infrastructure. We ask what vulnerabilities we expose in each axis, what they look like, and what their consequences are.
Use the figure as a review checklist: identify attack vectors, examine design, implementation, and infrastructure vulnerabilities, then assess their consequences. section 1.1
