api-security-checklist

API Security Checklist

Overview

The OWASP API Security Top 10 (2023 edition, still current) orders API risk by how often it actually bites in production. This skill maps each category to a concrete Go/Java check instead of a paragraph of theory — see https://owasp.org/API-Security/editions/2023/en/0x11-t10/ for the source list.

Core principle: the most common API vulnerability is a lookup by id with no ownership check. Assume every id in a URL or body is adversarial.

API1: Broken Object-Level Authorization (BOLA)

The #1 API risk. A lookup that trusts the id alone instead of scoping it to the caller.

// ❌ anyone who guesses/enumerates an id can read or modify it
task, err := repo.Get(ctx, taskID)

// ✅ scoped to the caller/tenant exactly like its neighbours
task, err := repo.GetForOwner(ctx, taskID, ownerIDFromAuth(ctx))

Answer "not yours" the same way the endpoint's neighbours do — usually 404 (don't reveal existence to a non-owner) unless the repo already standardizes on 403. Test it: a second, different authenticated user requesting the first user's object must get the not-yours response, not the object.

API2: Broken Authentication

• New routes go in the SAME middleware group as their neighbours (Fiber: api := app.Group("/api", authMW), never a bare app.Post outside it; Spring: match the route in the existing SecurityFilterChain; Quarkus: @RolesAllowed/@Authenticated).
• Compare secrets/tokens with crypto/subtle.ConstantTimeCompare, never == (timing attack on string comparison).
• Generate tokens with crypto/rand, never math/rand.

API3: Broken Object Property-Level Authorization (BOPLA — mass assignment / excessive data exposure)

• The request DTO lists only the fields a client may set — never bind a request body directly onto a domain/entity struct that also has role, owner_id, is_admin, etc. If the DTO doesn't have the field, the client can't set it.
• The response DTO lists only the fields a client may read — no password_hash, no internal ids, no other users' data riding along in a list response. Go: unexported fields or explicit response structs, never json:"-" as the only defense on a type that's also bound from requests. Java: a dedicated response record, never the JPA entity.