Broken API Versioning Security
Overview
When APIs evolve through versions, older versions often lack security controls added in newer versions:
- Authentication may be optional in v1 but required in v2
- Input validation may differ between versions
- Rate limiting may only apply to newer API versions
- Deprecated endpoints may expose functionality removed for security reasons
Remediation
- Apply identical security controls to ALL active API versions
- Use shared security middleware that applies to all version routes
- Actively sunset old API versions with deprecation notices
- Monitor and alert on old API version usage