jim60105 API Security Development Guide
Structured approach to building secure APIs, covering OWASP API Security Top 10 (2023), secure design patterns, and verification checklists. Apply these guidelines throughout the API development lifecycle — from threat modeling to deployment monitoring.
Secure API Development Lifecycle
Phase 1: API Threat Modeling and Design
- Identify API attack surfaces: public endpoints, authenticated endpoints, admin endpoints, webhooks, third-party integrations
- Map data flows: what sensitive data crosses each API boundary
- Define authorization model: which users/roles access which resources and properties
- Design security controls:
- Centralized authentication (OAuth2/OIDC at API gateway)
- Object-level authorization at data access layer
- Schema-based input validation at every endpoint
- Rate limiting per endpoint sensitivity
- API versioning with deprecation strategy
Phase 2: Secure Implementation
Critical API Security Rules
| Never | Instead |
|---|---|
| Return full objects (to_dict/to_json) | Explicit response schemas with cherry-picked fields |
| Accept arbitrary fields for update | Allowlisted update schemas (prevent mass assignment) |
| Use sequential/guessable IDs in URLs | UUIDs/GUIDs for resource identifiers |
| Trust object ID alone for access | Check object ownership against authenticated user |
| Rely on client-side role checks | Server-side RBAC/ABAC middleware |
| Accept unlimited query params/body | Schema validation with size/type/range limits |
| Skip rate limiting on any endpoint | Rate limit ALL endpoints, stricter on auth/business flows |
| Return stack traces in errors | RFC 7807 Problem Details with generic messages |
| Trust third-party API responses | Validate and sanitize all external API data |
| Put API keys in URLs | Use Authorization header or secure key vault |
| Use wildcard CORS with credentials | Explicit origin allowlist |
| Allow unlimited GraphQL depth/complexity | Query depth + complexity + batch limits |
Reference detailed guides:
- For OWASP API Top 10 with code examples: See references/owasp-api-top-10.md
- For secure API design patterns: See references/secure-api-design.md
Phase 3: API Security Verification
- Schema Validation — Lint OpenAPI spec for security issues (Spectral)
- Static Analysis — Run SAST on API code (Semgrep, bandit)
- Contract Testing — Verify API behavior matches spec (Schemathesis, Dredd)
- Dynamic Testing — Run DAST against running API (OWASP ZAP, Burp Suite)
- Authorization Testing — Test every endpoint with wrong user/role/anonymous
- Rate Limit Testing — Verify all endpoints enforce limits
- Code Review — Apply API security checklists
Reference: See references/api-security-checklist.md
Phase 4: Deployment and Monitoring
- API gateway: auth offloading, rate limiting, request logging
- TLS 1.2+ enforcement, HSTS, security headers
- Structured logging (no tokens/PII in logs)
- Anomaly detection and alerting on security events
- API inventory management and version deprecation
- Incident response plan for API breaches
OWASP API Security Top 10 (2023) Quick Reference
| # | Risk | Key Concern | Primary Prevention |
|---|---|---|---|
| API1 | Broken Object Level Authorization | Accessing other users' resources by manipulating IDs | Object ownership check at data layer, use GUIDs |
| API2 | Broken Authentication | Weak auth, credential stuffing, JWT flaws | OAuth2/OIDC, short-lived tokens, rate limit auth |
| API3 | Broken Object Property Level Authorization | Excessive data exposure + mass assignment | Explicit response/request schemas, field allowlists |
| API4 | Unrestricted Resource Consumption | No rate/size/cost limits, GraphQL batching | Rate limiting, pagination caps, spending alerts |
| API5 | Broken Function Level Authorization | Regular users accessing admin functions | RBAC middleware, deny by default, test all roles |
| API6 | Unrestricted Access to Sensitive Business Flows | Automating business-critical operations (scalping, spam) | CAPTCHA, device fingerprinting, behavior analysis |
| API7 | Server Side Request Forgery | API fetches user-supplied URLs | URL allowlisting, block private IPs, disable redirects |
| API8 | Security Misconfiguration | Missing headers, CORS *, verbose errors, debug endpoints | Hardened defaults, security headers, minimal errors |
| API9 | Improper Inventory Management | Shadow APIs, deprecated versions, no documentation | API inventory, OpenAPI in CI/CD, retirement plans |
| API10 | Unsafe Consumption of APIs | Trusting third-party API data without validation | Validate all external data, enforce TLS, set timeouts |
For detailed attack scenarios and code examples: See references/owasp-api-top-10.md
API Security Review Workflow
Step-by-step procedure for reviewing API security:
- Map the API surface — List all endpoints, methods, auth requirements, and data flows. Check for undocumented/shadow endpoints.
- Check authentication — Verify every non-public endpoint requires valid authentication. Test with missing/expired/malformed tokens.
- Check object-level authorization (BOLA) — For every endpoint accepting resource IDs, verify users can only access their own resources.
- Check function-level authorization (BFLA) — Verify admin endpoints reject non-admin users. Test horizontal and vertical privilege escalation.
- Check property-level authorization — Verify responses only include authorized fields. Test mass assignment by sending extra fields in updates.
- Validate input handling — Check schema validation on all inputs. Test with oversized payloads, unexpected types, injection payloads.
- Check rate limiting — Verify limits on all endpoints, especially auth, business-critical, and resource-intensive operations.
- Check error handling — Verify no sensitive info in error responses. Test with invalid inputs, missing resources, server errors.
- Review third-party integrations — Verify external API responses are validated. Check for SSRF in URL-accepting endpoints.
- Check API inventory — Verify no deprecated/shadow endpoints are live. Check documentation matches reality.
- Report findings — Severity (Critical/High/Medium/Low), endpoint, vulnerable request, explanation, fix with code example.
API Security Testing Quick Commands
# === OpenAPI Spec Linting ===
npm install -g @stoplight/spectral-cli && spectral lint openapi.yaml
# === Property-based API Testing ===
pip install schemathesis && schemathesis run --checks all http://localhost:8000/openapi.json
# === Dynamic Security Scanning ===
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py -t http://target:8000/openapi.json -f openapi
# === API Fuzzing ===
# nuclei -u http://target:8000 -t api/
# === Static Analysis (Python API) ===
pip install bandit && bandit -r src/ -f json
pip install semgrep && semgrep --config=p/python --config=p/owasp-top-ten src/
Reference Files
- references/owasp-api-top-10.md — Detailed OWASP API Security Top 10 (2023) with attack scenarios, vulnerable → secure code examples for REST and GraphQL APIs
- references/secure-api-design.md — Secure API design patterns: authentication (OAuth2, JWT, API keys, mTLS), authorization (RBAC/ABAC), input validation, rate limiting, CORS, error handling, API gateway, monitoring
- references/api-security-checklist.md — Actionable checklists for API design review, auth, input validation, transport security, rate limiting, inventory, deployment, logging, and testing