API Security Auditor

API & Web Surface Auditor

Overview

Review everything exposed over the network: HTTP routes, GraphQL resolvers, websockets, and webhooks. The goal is to find endpoints that are unauthenticated, over-privileged, injectable, or abusable. Cite the exact route handler for each finding.

Checklist (OWASP API Top 10 aligned)

1. Broken object-level authorization (BOLA/IDOR) - object IDs accepted from the client without an ownership check.
2. Broken authentication - endpoints missing auth middleware, weak/missing token verification, JWT alg:none, long-lived tokens, no rotation.
3. Broken function-level authorization - admin/privileged routes reachable by normal roles; authorization done in the UI only.
4. Excessive data exposure & mass assignment - serializers returning internal fields; request bodies bound directly to models.
5. Injection & SSRF - user input reaching SQL/NoSQL/command/template sinks; user-supplied URLs fetched without an allowlist.
6. Resource abuse - no rate limiting/pagination caps, unbounded uploads, expensive GraphQL queries (no depth/complexity limit).
7. Transport & headers - HTTPS enforced, HSTS, CSP, X-Content-Type-Options, secure/HttpOnly/SameSite cookies.
8. CORS & CSRF - reflected Origin, wildcard Access-Control-Allow-Origin with credentials, state-changing GETs, missing CSRF tokens on cookie-auth forms.

Workflow

1. Enumerate every route/handler (router files, decorators, OpenAPI/GraphQL schema). Build a table: method, path, auth required?, roles, input sources.
2. For each, verify the auth + authz check actually runs before the handler logic, and that object access is scoped to the caller.
3. Test injection/SSRF paths by tracing input to sink.
4. Inspect middleware/config for headers, CORS, CSRF, and rate limits.
5. Report per finding: [SEVERITY] route - issue, proof (handler code), impact, and the minimal fix (middleware, scoping, header, limit).

Anti-patterns

• Assuming a global auth middleware covers a route without confirming it is applied
• Reporting CORS wildcards as critical when no credentials are allowed (rate correctly)
• Listing generic header advice without checking what the server already sets