API Security Checklist: Applying the OWASP API Top 10

APIs are the doors of modern software. Mobile apps, websites, partners and internal tools all use them to reach your data. Attackers know this, so APIs are now a common target.

This guide gives you a simple API security checklist. It works for a small team with one API and for a large firm with hundreds. It follows the OWASP API Security Top 10, a well-known list of the most serious API risks.

Why APIs need their own checklist

A web page shows only what a designer chose. An API returns raw data to anyone who asks the right way. If it forgets one check, an attacker can read other users’ records or change them.

APIs also change fast. Teams add endpoints, test versions and forgotten routes. Each one is a possible way in. Our guide to API-first strategy shows how to design APIs with care from the start.

The OWASP API Top 10

The OWASP API Security Top 10 (2023 edition) lists ten risks:

• Broken object level authorisation.
• Broken authentication.
• Broken object property level authorisation.
• Unrestricted resource consumption.
• Broken function level authorisation.
• Unrestricted access to sensitive business flows.
• Server side request forgery.
• Security misconfiguration.
• Improper inventory management.
• Unsafe consumption of APIs.

Use this list as the spine of your API security checklist. The sections below turn it into actions.

An API security checklist you can use

Know what you have

• List every API, version and environment.
• Name an owner for each one.
• Retire old versions and test routes.
• Record which APIs are public, partner only or internal.

You cannot protect what you cannot see. Poor inventory is a risk on its own.

Check who may do what

• Check access on every request, for every object. A user who asks for order 123 must own order 123.
• Check access to each field. Do not return data the caller does not need.
• Check the role for each function. Admin actions need admin checks on the server.
• Never rely on the app to hide a button.

These checks cover the first, third and fifth risks, and they cause many real breaches.

Prove identity well

• Use proven standards such as OAuth and OpenID Connect.
• Use short-lived tokens and safe refresh.
• Protect login and password reset with limits and extra checks.
• Support multi-factor sign-in for sensitive actions.
• Never put secrets in URLs.

Limit use

• Set rate limits per user, key and address.
• Cap page sizes, upload sizes and request time.
• Watch costs for paid back-end calls, such as text messages or AI services.
• Protect business flows that bots abuse, such as sign-up, booking and checkout.

Validate everything

• Check type, length, range and format on every input.
• Reject unknown fields.
• Block calls that make your server fetch addresses chosen by the caller, unless you control the list.
• Encode output to avoid injection into other systems.

Harden the set-up

• Use encrypted connections everywhere.
• Turn off debug modes and detailed errors in production.
• Set strict cross-origin rules.
• Keep servers, libraries and gateways updated. See our guide to software supply chain security.
• Apply least privilege to service accounts.

Treat other APIs with care

When you call a partner or vendor API, validate what comes back. Set time limits, and plan for failure. A weak partner should not become your weak point.

Log, watch and respond

• Log who called what, when and with what result.
• Alert on odd patterns, such as one user reading thousands of records.
• Keep logs safe, and remove secrets from them.
• Have a response plan. See incident response planning.

Test your APIs

1. Review the design before coding, and model the threats.
2. Scan the code and dependencies in your build pipeline. See our CI/CD starter pipeline.
3. Run automated tests for access rules, using two test users.
4. Run manual tests against the OWASP list.
5. Hire an independent tester before major releases.
6. Share a way to report problems.

Add these tests to your wider test automation strategy. For mobile apps, also see our mobile app security checklist.

Common mistakes

• No list of APIs, so old versions stay open.
• Checking login, but not object ownership.
• Returning whole records and hoping the app hides fields.
• No rate limits.
• Detailed error messages in production.
• Trusting partner data without checks.
• No logs, so attacks go unseen.

A starting plan

1. Build the API inventory this month.
2. Test the top five APIs for object level access flaws.
3. Add rate limits and input checks at the gateway.
4. Turn on logging and alerts.
5. Repeat the API security checklist every release.

How SoftSapien supports API security

SoftSapien’s engineers and security consultants build APIs with security in the design, run API security checklist reviews and tests, and set up monitoring. See our cybersecurity consulting and enterprise software integration services.

To secure your APIs, use the contact page to chat with our team, send a message or schedule a free consultation call.