Skip to content

OWASP API Security

Open Worldwide Application Security Project OWASP is a non-profit and collaborative online community that aims to improve application security via a set of security principles, articles, documentation etc.

Talend API Tester - Free Edition: Visually interact with REST, SOAP and HTTP APIs.

API

Stands for Application Programming Interface, It is a middleware that facilitates the communication of two software utilising a set of protocols and definitions.

application refers to any software having specific functionality, and interface refers to the service contract between two apps that make communication possible via requests and responses.

Vulnerabilities

  • Broken Object Level Authorisation (BOLA)
  • Broken User Authentication (BUA)
  • Excessive Data Exposure
  • Broken Function Level Authorisation
  • Mass Assignment: When client-side data is automatically bound with server-side objects or class variables.
  • Security Misconfiguration: incorrect and poorly configured security controls.
  • Injection: when user input is not filtered and is directly processed by an API
  • Improper Assets Management : Two versions of an API available in our system

Mitigation Measures BUA

  • Ensure complex passwords with higher entropy for end users.
  • Do not expose sensitive credentials in GET or POST requests.
  • Enable strong JSON Web Tokens (JWT), authorisation headers etc. *Ensure the implementation of multifactor authentication (where possible), account lockout, or a captcha system to mitigate brute force against particular users.
  • Ensure that passwords are not saved in plain text in the database to avoid further account takeover by the attacker.

Mitigation Excessive Data Exposure

  • Never leave sensitive data filtration tasks to the front-end developer.
  • Ensure time-to-time review of the response from the API to guarantee it returns only legitimate data and checks if it poses any security issue.
  • Avoid using generic methods such as to_string() and to_json().
  • Use API endpoint testing through various test cases and verify through automated and manual tests if the API leaks additional data.

Mitigation Broken Function Level Authorisation

  • Ensure proper design and testing of all authorisation systems and deny all access by default.
  • Ensure that the operations are only allowed to the users belonging to the authorised group.
  • Make sure to review API endpoints against flaws regarding functional level authorisation and keep in mind the apps and group hierarchy's business logic.

Mitigation Mass Assignment

  • Before using any framework, one must study how the backend insertions and updates are carried out. In the Laravel framework, fillable and guarded(opens in new tab) arrays mitigate the above-mentioned scenarios.
  • Avoid using functions that bind an input from a client to code variables automatically.
  • Allowlist those properties only that need to get updated from the client side.

Mitigation Security Misconfiguration

  • Limit access to the administrative interfaces for authorised users and disable them for other users.
  • Disable default usernames and passwords for public-facing devices (routers, Web Application Firewall etc.).
  • Disable directory listing and set proper permissions for every file and folder.
  • Remove unnecessary pieces of code snippets, error logs etc. and turn off debugging while the code is in production

Mitigation Injections

  • Ensure to use a well-known library for client-side input validation.
  • If a framework is not used, all client-provided data must be validated first and then filtered and sanitised.
  • Add necessary security rules to the Web Application Firewall (WAF). Most of the time, injection flaws can be mitigated at the network level.
  • Make use of built-in filters in frameworks like Laravel, Code Ignitor etc., to validate and filter data.

Mitigation Improper Assets Management

  • Access to previously developed sensitive and deprecated API calls must be blocked at the network level.
  • APIs developed for R&D, QA, production etc., must be segregated and hosted on separate servers.
  • Ensure documentation of all API aspects, including authentication, redirects, errors, CORS policy, and rate limiting.
  • Adopt open standards to generate documentation automatically.