OWASP API Top 10
ELI5 — The Vibe Check
The OWASP API Top 10 is a cheat sheet of the most common ways APIs get hacked. Broken auth, excessive data exposure, mass assignment — the greatest hits of API insecurity. If you build APIs and haven't read this, you're probably vulnerable to at least three of them right now.
Real Talk
The OWASP API Security Top 10 catalogs the most critical API security risks: Broken Object Level Authorization (BOLA), Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption, Broken Function Level Authorization, SSRF, Security Misconfiguration, Lack of Protection from Automated Threats, Improper Asset Management, and Unsafe Consumption of APIs.
When You'll Hear This
"BOLA is #1 on the OWASP API Top 10 — always check that users can only access their own resources." / "We review every API endpoint against the OWASP API Top 10 before release."
Related Terms
API Security
API security is protecting your APIs from abuse, data leaks, and unauthorized access. It covers authentication (who are you?), authorization (can you do th
Authorization (AuthZ)
Authorization is deciding what you're allowed to do after you've proven who you are.
DAST
DAST attacks your running application to find vulnerabilities — like hiring a friendly hacker to poke at your website.
SAST
SAST scans your source code for security bugs WITHOUT running it.