OWASP API Security Top 10

OWASP API Security Top 10 (2023) Reference

Purpose

Identify API-specific security vulnerabilities based on the OWASP API Security Top 10 (2023 edition), including REST, GraphQL, and gRPC patterns. APIs are the primary attack surface for modern applications, and these vulnerability classes represent the most critical and commonly exploited API security risks.

When to Use

Activate this skill when:

• Auditing REST API endpoints and route handlers
• Reviewing GraphQL schemas, resolvers, and configurations
• Assessing gRPC service definitions and interceptors
• Evaluating API authentication and authorization logic
• Testing rate limiting and resource consumption controls
• Reviewing API gateway configurations

API1:2023 - Broken Object Level Authorization (BOLA)

Description: API endpoints that accept object IDs and do not verify that the authenticated user has permission to access the referenced object.

Pattern: ID parameters used directly in database queries without ownership checks.

Vulnerable Code Examples:

Express.js:

// VULNERABLE: No ownership check
app.get('/api/orders/:id', auth, async (req, res) => {
  const order = await Order.findById(req.params.id);
  res.json(order); // Any authenticated user can access any order
});

Flask:

# VULNERABLE: No ownership check
@app.route('/api/orders/<int:order_id>')
@login_required
def get_order(order_id):
    order = Order.query.get_or_404(order_id)
    return jsonify(order.to_dict())  # Missing: order.user_id == current_user.id

Spring:

// VULNERABLE: No ownership check
@GetMapping("/api/orders/{id}")
public Order getOrder(@PathVariable Long id) {
    return orderRepository.findById(id)
        .orElseThrow(); // Any authenticated user can access any order
}

Go (net/http):

// VULNERABLE: No ownership check
func getOrder(w http.ResponseWriter, r *http.Request) {
    id := mux.Vars(r)["id"]
    order, _ := db.GetOrder(id) // Missing: order.UserID == authenticatedUser.ID
    json.NewEncoder(w).Encode(order)
}