sc-api-security

SC: API Security Audit

Purpose

Performs a comprehensive security audit of API endpoints covering broken object-level authorization, broken function-level authorization, excessive data exposure, missing rate limiting, mass assignment, security misconfiguration, and injection via API parameters. Covers REST, GraphQL, and gRPC API patterns, aligned with the OWASP API Security Top 10.

Activation

Called by sc-orchestrator during Phase 2 when APIs are detected in the architecture.

Phase 1: Discovery

Keyword Patterns to Search

# REST
"app.get(", "app.post(", "app.put(", "app.delete(", "app.patch(",
"router.get(", "@GetMapping", "@PostMapping", "@app.route(",
"[HttpGet]", "[HttpPost]", "r.GET(", "r.POST("

# GraphQL
"typeDefs", "resolvers", "Mutation", "Query", "Subscription"

# gRPC
".proto", "service ", "rpc ", "grpc.Server"

# API configuration
"swagger", "openapi", "api-docs", "Swashbuckle"

OWASP API Security Top 10 Checks

1. Broken Object Level Authorization (BOLA/IDOR):

• API endpoints accepting resource IDs without ownership verification
• See sc-authz for detailed IDOR patterns

2. Broken Authentication:

• Missing auth on sensitive endpoints
• Weak token generation
• See sc-auth for details

3. Broken Object Property Level Authorization:

// VULNERABLE: Returning all user fields including sensitive ones
app.get('/api/users/:id', async (req, res) => {
  const user = await User.findById(req.params.id);
  res.json(user);  // Includes passwordHash, internalId, role, etc.
});

// SAFE: Return only needed fields
app.get('/api/users/:id', async (req, res) => {
  const user = await User.findById(req.params.id).select('name email avatar');
  res.json(user);
});

4. Unrestricted Resource Consumption:

• Missing pagination limits (?limit=999999)
• No request size limits
• No rate limiting
• See sc-rate-limiting for details

5. Broken Function Level Authorization:

• Admin API endpoints without role checking middleware
• See sc-privilege-escalation for details