charlieviettq API security testing
Preconditions
- Test in non-production unless explicitly authorized.
- Use dedicated test accounts; never real customer PII in payloads.
Test matrix (prioritized)
Authentication and session
- Missing/invalid token rejected (401)
- Expired or revoked credentials rejected
- Session fixation / cookie flags (HttpOnly, Secure, SameSite) where applicable
Authorization
- Horizontal: user A cannot access user B's resource IDs
- Vertical: non-admin cannot invoke admin routes
- IDOR on path/query/body identifiers
Input and abuse
- Oversized payloads rejected
- Injection surfaces parameterized (SQL, command, template)
- Rate limiting on auth and expensive endpoints
Data exposure
- Errors do not leak stack traces or secrets in prod-like config
- Responses omit internal fields (tokens, hashes, full PAN)
- Pagination does not bypass auth filters
Transport and config
- HTTPS enforced; HSTS where applicable
- CORS not
*with credentials - Security headers on API gateway if present
Web-facing surfaces (when API serves or pairs with UI)
- CSP or explicit script policy documented
- CSRF protection on cookie-based mutations
- Clickjacking headers (
X-Frame-Optionsor CSPframe-ancestors) where relevant - File upload: type/size limits, virus scan hook if required by policy
Reporting
For each finding: endpoint, steps, impact, severity, remediation, retest status.
Boundaries
- Defensive testing only; no unauthorized production scanning.
- For deep pen-test, engage formal AppSec process.