Modern apps are mostly APIs: the mobile app, the web front end and partner integrations all talk to the same backend. The OWASP API Security Top 10 (2023 edition) lists the risks that show up most often. Here they are in plain language.

API1: Broken Object Level Authorization (BOLA)

The API returns an object, such as an order or an invoice, without checking it belongs to the caller. Change the ID, get someone else's data. Fix: check ownership on every object access. Our IDOR article covers this in depth.

API2: Broken Authentication

Weak login flows: no rate limiting on login or password reset, tokens that never expire, or JWTs that aren't properly verified. Fix: use proven authentication libraries, short-lived tokens and lockouts.

API3: Broken Object Property Level Authorization

The API exposes or accepts fields it shouldn't, like returning a user's password hash, or letting a user set "role": "admin" in an update request (mass assignment). Fix: explicitly list which fields can be read and written per role.

API4: Unrestricted Resource Consumption

No limits on request rates, page sizes or upload sizes, so one client can overload the service or run up your cloud or SMS bill. Fix: rate limits, pagination caps and quotas.

API5: Broken Function Level Authorization

Admin-only endpoints that ordinary users can call, because the check exists in the UI but not the API. Fix: enforce role checks on the server for every endpoint.

API6: Unrestricted Access to Sensitive Business Flows

Legitimate features abused at scale, like bots buying all the stock, mass account creation or coupon abuse. Fix: identify sensitive flows and add bot protection, limits or extra verification.

API7: Server-Side Request Forgery (SSRF)

The API fetches a URL the user supplies, such as for a webhook or an image import, and can be pointed at internal services or cloud metadata endpoints. Fix: allow-list destinations and block internal address ranges.

API8: Security Misconfiguration

Verbose error messages, permissive CORS, missing security headers, debug endpoints left on. Fix: hardened, consistent configuration across environments.

API9: Improper Inventory Management

Old API versions, forgotten test endpoints and undocumented "shadow" APIs that still work but no longer get security updates. Fix: keep an inventory and retire old versions.

API10: Unsafe Consumption of APIs

Trusting data from third-party APIs more than user input, and passing it on without validation. Fix: validate and sanitise everything that comes from outside, partners included.

Notice the pattern: three of the ten (API1, API3, API5) are authorisation failures. Scanners rarely catch them, because the responses look normal. They need a person testing with multiple accounts.

Our API penetration tests cover the full Top 10. Request a quote.