OWASP API Security Top 10 - 2023

Address API2:2023 Broken Authentication + token management per OWASP API Security Top 10 2023. Broken Authentication occurs when authentication mechanisms are weak + improperly implemented + or bypassable. Mitigations include (a) implement strong authentication (OAuth 2.0 + OIDC + FAPI 2.0 where applicable) + (b) require multi-factor authentication for sensitive operations + privileged accounts + (c) implement rate limiting + account lockout against brute force + credential stuffing, (d) use short-lived access tokens + refresh token rotation + sender-constrained tokens (DPoP + mTLS), (e) protect against session fixation + replay + token theft + (f) maintain secure token storage on client + server, (g) implement proper session termination + logout including all-device logout. Secret and Token Management for APIs (OWASP-API-PRG-04) must (a) maintain secrets in dedicated secret store + (b)

• OWASP API Top 10 evidence for OWASPAPI-2

• test coverage incomplete

Address API1:2023 Broken Object Level Authorization (BOLA) + API5:2023 Broken Function Level Authorization (BFLA) per OWASP API Security Top 10 2023. BOLA occurs when an API endpoint exposes endpoints handling object identifiers without verifying that the user is authorised to access the specified object. BFLA occurs when authorisation checks for function-level access are missing or improperly implemented (e.g. allowing role escalation via different HTTP methods or endpoint paths). Mitigations include (a) implement authorisation at every API endpoint that retrieves data by ID, (b) enforce role-based access control (RBAC) and attribute-based access control (ABAC), (c) use unpredictable UUIDs over sequential IDs where appropriate, (d) test thoroughly across user roles + tenancy boundaries + with negative testing, (e) implement consistent enforcement at gateway + service layers + (f) integr

• OWASP API Top 10 evidence for OWASPAPI-1

• test coverage incomplete

Address API9:2023 Improper Inventory Management + API10:2023 Unsafe Consumption of APIs per OWASP API Security Top 10 2023. Improper Inventory Management occurs when APIs are deployed without proper documentation + version control + decommissioning leading to shadow APIs + zombie APIs + improperly retired endpoints. Unsafe Consumption of APIs occurs when an application consumes external APIs without proper validation + sanitisation + trust assessment of received data exposing to supply chain attacks. Mitigations include (a) maintain API inventory + lifecycle management + retirement procedures + (b) maintain documentation + OpenAPI specifications + (c) implement API gateway + observability, (d) validate consumed external API responses + treat as untrusted input, (e) maintain monitoring for shadow + zombie APIs + (f) implement strict validation + sanitisation + isolation when consuming ext

• OWASP API Top 10 evidence for OWASPAPI-7

• test coverage incomplete

Address API8:2023 Security Misconfiguration + OWASP-API-PRG-01 Secure API Design and Threat Modelling per OWASP API Security Top 10 2023. Security Misconfiguration occurs when API or its supporting stack has security headers + permissions + protocols + or features improperly configured. Mitigations include (a) implement hardened baseline configurations across API stack + cloud infrastructure + (b) maintain configuration management with drift detection + remediation + (c) apply security headers (HSTS + CSP + X-Content-Type-Options + similar where applicable) + (d) disable unnecessary features + endpoints + verbose error messages + debug endpoints, (e) maintain CORS configuration + appropriate to actual use cases, (f) use up-to-date TLS + cipher suites. Secure API Design and Threat Modelling (OWASP-API-PRG-01) must (a) conduct threat modelling at design phase + (b) document threat model pe

• OWASP API Top 10 evidence for OWASPAPI-6

• test coverage incomplete

Address API3:2023 Broken Object Property Level Authorization (BOPLA) per OWASP API Security Top 10 2023. BOPLA combines previous API3 Excessive Data Exposure and API6 Mass Assignment categories. BOPLA occurs when an API exposes more properties than the authenticated user is entitled to read or allows the user to modify properties they should not be able to modify. Mitigations include (a) implement explicit object-to-output schema mapping with allowlist of fields per role + use case, (b) avoid generic serialisation that exposes all object properties, (c) validate input + reject unexpected properties + use explicit input schema, (d) implement property-level access control where appropriate, (e) test for over-disclosure + over-permissive update patterns.

• OWASP API Top 10 evidence for OWASPAPI-3

• test coverage incomplete

Address API4:2023 Unrestricted Resource Consumption + API6:2023 Unrestricted Access to Sensitive Business Flows per OWASP API Security Top 10 2023. Unrestricted Resource Consumption occurs when APIs do not limit CPU + memory + network + disk + database + or external API consumption by clients allowing DoS or cost amplification attacks. Unrestricted Access to Sensitive Business Flows occurs when APIs expose business workflows (account creation + ticket purchase + comment posting + transaction approval) to abuse via automation + scraping + scalping + fake review generation. Mitigations include (a) implement rate limiting at gateway + service layers per endpoint per client + (b) implement quota management for resource-intensive operations, (c) bot management for sensitive business flows including CAPTCHA + device fingerprinting + behavioural analysis + (d) cost controls for expensive operat

• OWASP API Top 10 evidence for OWASPAPI-4

• test coverage incomplete

Address API7:2023 Server Side Request Forgery (SSRF) + input validation per OWASP API Security Top 10 2023 + OWASP-API-PRG-05 Input and Output Validation. SSRF occurs when an API fetches a remote resource without validating the user-supplied URL allowing internal network access + cloud metadata service access + or other unauthorised target access. Mitigations include (a) implement URL allowlist for fetching external resources + (b) block internal IP ranges + cloud metadata service IPs (169.254.169.254 + similar) + (c) use DNS resolution checking + (d) enforce schemes + protocols + ports + (e) implement network-level egress controls. Input and Output Validation must (a) validate input format + length + content + (b) sanitise + escape output appropriate to context (HTML + URL + JSON + SQL + LDAP + similar) + (c) use parameterised queries against SQL injection + (d) implement output encodin

• OWASP API Top 10 evidence for OWASPAPI-5

• test coverage incomplete

Operate automated security testing + logging + monitoring per OWASP-API-PRG-02 + OWASP-API-PRG-03. Automated Security Testing in CI/CD must (a) integrate API security testing (SAST + DAST + IAST + API-specific tools) into CI/CD pipeline + (b) maintain test coverage for OWASP API Top 10 + business logic + authentication + authorisation + (c) implement security gates blocking deployment for critical findings + (d) maintain regression testing for known issues. API Logging Monitoring and Detection must (a) collect comprehensive API access logs including authentication + authorisation + request/response metadata + errors + (b) integrate with SIEM for correlation + detection + (c) implement anomaly detection for unusual API access patterns + abuse + automation + (d) maintain alerting + triage + investigation capability + (e) align retention with regulatory + investigative + governance requirem

• OWASP API Top 10 evidence for OWASPAPI-8

• test coverage incomplete