Backend ServicesBy Abdul Rahman01 Apr 20263 min read
API Security in Practice: The OWASP API Security Top 10
Most data breaches now involve APIs. A developer-focused walkthrough of the OWASP API Security Top 10 — broken object authorisation, authentication flaws, rate limiting and more.
APIs power every modern product — web apps, mobile apps, integrations and now AI agents. They're also the most common target for attackers, because they expose data and business logic directly. The OWASP API Security Top 10 summarises the vulnerabilities seen most often in real-world breaches. Here's what each means for day-to-day backend work.
Each layer stops a different class of attack; no single layer is enough.
1. Broken Object Level Authorisation (BOLA)
The number-one API vulnerability: an endpoint checks that the user is logged in, but not that they own the requested object.
// ❌ Any logged-in user can read any invoice by changing the ID
app.get("/invoices/:id", auth, async (req, res) => {
res.json(await Invoice.findById(req.params.id));
});
// ✅ Scope the lookup to the caller's tenant/owner
app.get("/invoices/:id", auth, async (req, res) => {
const invoice = await Invoice.findOne({ _id: req.params.id, tenantId: req.user.tenantId });
if (!invoice) return res.status(404).end();
res.json(invoice);
});
In multi-tenant systems this is the check that keeps one customer's data away from another's.
2. Broken Authentication
Weak token handling, missing expiry, predictable reset links and unlimited login attempts. Use proven libraries, short-lived tokens, secure password hashing (bcrypt or Argon2) and rate-limited login and reset endpoints.
3. Broken Object Property Level Authorisation
Two sides of one problem: excessive data exposure (returning passwordHash or internal fields) and mass assignment (accepting { "role": "admin" } in an update). Return explicit response shapes and whitelist writable fields.
4. Unrestricted Resource Consumption
No limits on request rate, page size, upload size or expensive operations invites denial of service — and, with paid AI or SMS APIs behind you, surprise bills. Enforce rate limits per user and IP, cap pagination and payload sizes, and set timeouts.
5. Broken Function Level Authorisation
Admin endpoints reachable by regular users because the check is missing on one route. Deny by default and require every route to declare its permission.
6. Unrestricted Access to Sensitive Business Flows
Automated abuse of legitimate features — mass account creation, ticket scalping, coupon abuse. Protect sensitive flows with rate limits, bot detection and step-up verification.
7. Server-Side Request Forgery (SSRF)
Features that fetch a user-supplied URL (webhooks, link previews, imports) can be tricked into calling internal services or cloud metadata endpoints. Validate and allow-list destinations, and block private IP ranges.
8. Security Misconfiguration
Verbose error messages, permissive CORS, missing security headers, default credentials and debug endpoints left enabled in production.
9. Improper Inventory Management
Forgotten API versions, test environments and undocumented endpoints that don't receive security fixes. Keep an inventory, document with OpenAPI and retire old versions deliberately.
10. Unsafe Consumption of APIs
Trusting data from third-party APIs more than user input. Validate external responses, use timeouts, and treat integrations — including AI model outputs — as untrusted.
A Practical Checklist
- Authorise every object against the caller, not just the route.
- Validate all input with schemas and return explicit, minimal responses.
- Rate-limit, paginate and cap sizes everywhere.
- Log authentication failures and authorisation denials, and alert on spikes.
Key Takeaways
- BOLA — missing ownership checks — is the most common and most damaging API flaw.
- Control what goes in (validation, mass assignment) and what comes out (data exposure).
- Limit resource consumption to prevent abuse and runaway costs.
- Treat third-party and AI responses as untrusted input.
