OWASP API Security Top 10

OWASP API Security Top 10 (2023) Reference

Purpose

Identify API-specific security vulnerabilities based on the OWASP API Security Top 10 (2023 edition), including REST, GraphQL, and gRPC patterns. APIs are the primary attack surface for modern applications, and these vulnerability classes represent the most critical and commonly exploited API security risks.

When to Use

Activate this skill when:

• Auditing REST API endpoints and route handlers
• Reviewing GraphQL schemas, resolvers, and configurations
• Assessing gRPC service definitions and interceptors
• Evaluating API authentication and authorization logic
• Testing rate limiting and resource consumption controls
• Reviewing API gateway configurations

API1:2023 - Broken Object Level Authorization (BOLA)

Description: API endpoints that accept object IDs and do not verify that the authenticated user has permission to access the referenced object.

Pattern: ID parameters used directly in database queries without ownership checks.

Vulnerable Code Examples:

Express.js:

// VULNERABLE: No ownership check
app.get('/api/orders/:id', auth, async (req, res) => {
  const order = await Order.findById(req.params.id);
  res.json(order); // Any authenticated user can access any order
});

Flask:

# VULNERABLE: No ownership check
@app.route('/api/orders/<int:order_id>')
@login_required
def get_order(order_id):
    order = Order.query.get_or_404(order_id)
    return jsonify(order.to_dict())  # Missing: order.user_id == current_user.id

Spring:

// VULNERABLE: No ownership check
@GetMapping("/api/orders/{id}")
public Order getOrder(@PathVariable Long id) {
    return orderRepository.findById(id)
        .orElseThrow(); // Any authenticated user can access any order
}

Go (net/http):

// VULNERABLE: No ownership check
func getOrder(w http.ResponseWriter, r *http.Request) {
    id := mux.Vars(r)["id"]
    order, _ := db.GetOrder(id) // Missing: order.UserID == authenticatedUser.ID
    json.NewEncoder(w).Encode(order)
}

Detection Patterns:

# Express: Route params used directly in DB queries
grep -rniE "req\.params\.\w+" --include="*.js" --include="*.ts" -A 5 | grep -iE "(findById|findOne|findByPk|where)"

# Flask: Route parameters in DB queries without ownership check
grep -rniE "def\s+\w+\(.*_id\)" --include="*.py" -A 10 | grep -iE "(query\.get|filter_by|find_one)"

# Spring: PathVariable in repository calls
grep -rniE "@PathVariable" --include="*.java" -A 5 | grep -iE "(findById|getOne|findOne)"

# Go: URL parameters in DB calls
grep -rniE "(mux\.Vars|chi\.URLParam|r\.URL\.Query)" --include="*.go" -A 5 | grep -iE "(GetOrder|FindBy|QueryRow)"

# Generic: Look for endpoints with ID params lacking authorization
grep -rniE "(/:id|/<int:|/{id}|\{id\})" --include="*.js" --include="*.ts" --include="*.py" --include="*.java" --include="*.go"

Fix Pattern: Always verify that the authenticated user owns or has permission to access the requested resource:

order = Order.query.get_or_404(order_id)
if order.user_id != current_user.id:
    abort(403)

API2:2023 - Broken Authentication

Description: Weak or missing authentication mechanisms on API endpoints.

Vulnerable Patterns:

| Pattern | Risk | Detection | |---------|------|-----------| | API key in URL query string | HIGH | grep -rniE "api[_-]?key=.[?&]" --include=".js" --include="*.py" | | No rate limiting on auth endpoints | HIGH | Check /login, /auth, /token for rate limit middleware | | JWT with none algorithm | CRITICAL | grep -rniE "algorithm.*none\|alg.none" --include=".py" --include=".js" | | Missing token expiration | HIGH | grep -rniE "expiresIn\|exp" --include=".js" --include=".py" (check if absent) | | Hardcoded JWT secret | CRITICAL | grep -rniE "(jwt_secret\|JWT_SECRET\|secret_key)\s=\s*[\"']" --include=".py" --include=".js" | | Password in API response | HIGH | Check serialization excludes password fields | | No authentication on sensitive endpoints | CRITICAL | Routes without auth, authenticate, login_required middleware |

Per-Framework Detection:

# Express: Routes without auth middleware
grep -rniE "app\.(get|post|put|delete|patch)\s*\(" --include="*.js" --include="*.ts" | grep -viE "(auth|protect|verify|middleware|passport)"

# Flask: Routes without login_required
grep -rniE "@app\.route" --include="*.py" -A 2 | grep -viE "(login_required|jwt_required|auth)"

# Spring: Endpoints without @PreAuthorize or security config
grep -rniE "@(Get|Post|Put|Delete)Mapping" --include="*.java" -B 3 | grep -viE "(PreAuthorize|Secured|RolesAllowed)"

# Go: Handlers without auth middleware in chain
grep -rniE "HandleFunc|Handle\(" --include="*.go" | grep -viE "(auth|middleware|protect)"

API3:2023 - Broken Object Property Level Authorization

Description: API exposes object properties that the user should not be able to read (excessive data exposure) or write (mass assignment).

Excessive Data Exposure Patterns:

# Returning entire ORM objects without field filtering
grep -rniE "\.to_dict\(\)|\.toJSON\(\)|jsonify\(\w+\)|res\.json\(\w+\)" --include="*.py" --include="*.js"

# Spring: Returning entity directly
grep -rniE "return\s+\w+Repository\.find" --include="*.java"

# Missing field selection in serialization
grep -rniE "JSON\.stringify\(user\)|json\.dumps\(\w+\.__dict__\)" --include="*.js" --include="*.py"

Mass Assignment Patterns:

# Express: Spreading request body into model
grep -rniE "\.create\(\s*req\.body\)|\.update\(\s*req\.body\)|Object\.assign\(\w+,\s*req\.body\)" --include="*.js" --include="*.ts"

# Flask: Direct assignment from request
grep -rniE "request\.(json|form|data)" --include="*.py" -A 3 | grep -iE "\*\*|update\(|setattr"

# Spring: No @JsonIgnore on sensitive fields
grep -rniE "class\s+\w+(Entity|Model|DTO)" --include="*.java" -A 20 | grep -iE "(password|role|admin|isAdmin|permissions)"

# Ruby on Rails: permit all params
grep -rniE "params\.permit!" --include="*.rb"
grep -rniE "attr_accessible" --include="*.rb"

API4:2023 - Unrestricted Resource Consumption

Description: API does not restrict the size or number of resources that can be requested, leading to denial of service, excessive costs, or resource exhaustion.

Vulnerable Patterns:

| Pattern | Risk | Detection | |---------|------|-----------| | No pagination on list endpoints | HIGH | List endpoints returning all records | | Missing limit/offset caps | HIGH | User-controlled page sizes without maximum | | Unbounded file uploads | HIGH | No size limits on multipart/form-data | | Regex DoS (ReDoS) | MEDIUM | Evil regex patterns on user input | | No rate limiting | HIGH | Endpoints without express-rate-limit, flask-limiter, etc. | | Unbounded query depth (GraphQL) | HIGH | No query depth limit configuration |

Detection Patterns:

# Unbounded queries (no limit/pagination)
grep -rniE "\.(find|findAll|select|query)\s*\(" --include="*.js" --include="*.ts" --include="*.py" | grep -viE "(limit|paginate|take|first|top)"

# Missing rate limiting middleware
grep -rniE "(express-rate-limit|flask.limiter|RateLimiter|throttle)" --include="*.js" --include="*.ts" --include="*.py" --include="*.java"

# Unbounded file upload size
grep -rniE "(multer|busboy|formidable|FileUpload)" --include="*.js" --include="*.ts" | grep -viE "(limit|maxFileSize|maxSize)"

# User-controlled page size without cap
grep -rniE "(pageSize|page_size|limit|per_page)\s*=\s*(req\.|request\.)" --include="*.js" --include="*.ts" --include="*.py"

API5:2023 - Broken Function Level Authorization

Description: Administrative or privileged endpoints accessible to regular users due to missing role-based access control.

Vulnerable Patterns:

# Admin routes without role check
grep -rniE "(\/admin|\/manage|\/internal|\/debug|\/system)" --include="*.js" --include="*.ts" --include="*.py