OWASP API Security Top 10:2023

API1:2023

Broken Object Level Authorization

Broken Object Level Authorization, often called BOLA, occurs when an API accepts an object identifier such as a user, order, or document ID without proving the caller owns or may access that object. A normal user can change an ID in a request to read, alter, or delete another account's data.

Why it matters

Changing an identifier can expose or change another customer's record, file, payment, or transaction.

Risk-reduction focus

• Authorize every object reference server-side.
• Use tenant-aware data access patterns.
• Test create, read, update, delete, and export paths.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API2:2023

Broken Authentication

Broken Authentication means an API misidentifies clients or fails to protect credentials and tokens. Predictable tokens, unchecked signatures or expiry, unlimited password guessing, and sessions that survive password change can let an attacker call every trusting endpoint as someone else.

Why it matters

An attacker can impersonate a user or service and access the API with an invalid or stolen identity.

Risk-reduction focus

• Use established identity protocols and token validation.
• Protect credential issuance, rotation, and revocation.
• Rate-limit and monitor authentication and recovery.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API3:2023

Broken Object Property Level Authorization

Broken Object Property Level Authorization occurs when an API authorizes an object but not which fields a caller may read or change. A response may expose salary or internal flags, or a request may accept isAdmin. It combines the roots of excessive data exposure and mass assignment.

Why it matters

Sensitive fields can leak, or a client can alter a role, price, workflow state, or internal-only attribute.

Risk-reduction focus

• Define explicit read and write schemas by role.
• Return only fields required by each use case.
• Reject mass assignment and unknown properties.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API4:2023

Unrestricted Resource Consumption

Unrestricted Resource Consumption means an API lacks suitable limits for request volume, payload size, pagination, query complexity, or paid downstream calls such as SMS and biometrics. A malicious or faulty client can consume CPU, memory, bandwidth, or provider credit until cost or availability suffers.

Why it matters

A client can degrade service, create unexpected cost, or make critical API functions unavailable to others.

Risk-reduction focus

• Set rate, size, depth, and time limits.
• Apply quotas and cost-aware controls by client.
• Monitor saturation and degrade safely.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API5:2023

Broken Function Level Authorization

Broken Function Level Authorization means user and administrator endpoints are not clearly separated or roles are not checked for every sensitive function, such as export, approve, refund, or user administration. A caller with an ordinary token can guess a path or method and invoke elevated work directly.

Why it matters

A normal user can invoke administrative, approval, reporting, or configuration actions.

Risk-reduction focus

• Enforce function permissions in the API layer.
• Deny by default and centralize policy decisions.
• Test every role against every sensitive endpoint.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API6:2023

Unrestricted Access to Sensitive Business Flows

Unrestricted Access to Sensitive Business Flows means an API exposes a legitimate business action without compensating for large-scale automation. Ticket buying, coupon use, account registration, or comment posting may be correct functions, yet harmful when a machine repeats them at scale. The gap is business abuse control, not necessarily injection.

Why it matters

Attackers can exhaust inventory, manipulate promotions, enumerate offers, or overwhelm verification and booking flows.

Risk-reduction focus

• Model abuse cases for valuable workflows.
• Use rate, velocity, and fraud controls suited to the flow.
• Observe business metrics and investigate anomalies.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API7:2023

Server Side Request Forgery

Server Side Request Forgery, or SSRF, occurs when an API fetches a caller-supplied URL without strict destination validation. An attacker can coerce a trusted server to reach an internal service, metadata endpoint, or destination unavailable through the external firewall.

Why it matters

The server can be used to reach internal services, metadata endpoints, or trusted network resources.

Risk-reduction focus

• Allow-list required destinations and protocols.
• Block private, loopback, and metadata ranges as appropriate.
• Use egress controls and log outbound requests.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API8:2023

Security Misconfiguration

API Security Misconfiguration is unsafe setup of gateways, servers, cloud services, CORS, TLS, error handling, or API features. Production introspection or debug endpoints, wildcard credentialed CORS, and unnecessary methods expand the attack surface even when business logic is correct.

Why it matters

Consumers may obtain debug data, invoke unnecessary methods, or connect to an exposed management surface.

Risk-reduction focus

• Harden gateways and cloud services from a baseline.
• Disable unused methods and detailed production errors.
• Continuously test configuration drift.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API9:2023

Improper Inventory Management

Improper Inventory Management means an organization does not fully know which API hosts, endpoints, versions, environments, and owners are exposed. Forgotten legacy APIs, public staging, and undocumented debug endpoints can miss patching and monitoring, giving attackers a path the team no longer remembers.

Why it matters

An old or shadow endpoint can remain internet-accessible with outdated controls or undocumented sensitive data.

Risk-reduction focus

• Maintain an owned inventory of API versions and hosts.
• Retire endpoints deliberately and remove stale DNS/routes.
• Document data classification and consumer contracts.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }

API10:2023

Unsafe Consumption of APIs

Unsafe Consumption of APIs occurs when a service trusts third-party API responses more than user input, then renders, queries, redirects, or updates records without validating schema and authorization. A compromised or faulty provider can turn the integrating service into a path that harms its own users.

Why it matters

A compromised or unreliable provider can inject bad data, trigger unsafe actions, or degrade a dependent service.

Risk-reduction focus

• Validate and constrain upstream responses.
• Use timeouts, authentication, and least privilege for integrations.
• Plan for provider failure and monitor dependency health.

// Vulnerable pattern: trust request-controlled target
app.Get("/records/:id", func(c fiber.Ctx) error {
  return c.JSON(repo.Find(c.Params("id")))
})

// Fixed pattern: authorize server-side
if !policy.CanRead(c.Locals("principal"), id) { return fiber.ErrForbidden }