Securing your API: The OWASP API Top 10 Rob Allen, October 2026

57% of organizations suffered an API-related data breach in the past two years Traceable 2025 Global State of API Security report Rob Allen ~ akrabat.com

OWASP API Security Top 10 Rob Allen ~ akrabat.com

Who are you and what can you access? Authentication and authorisation failures Rob Allen ~ akrabat.com

#1 #2 #2 #3 #4 #5 Broken Authentication #6 APIs that don’t properly verify who you are #8 #7 #9 #10 Rob Allen ~ akrabat.com

Broken Authentication #1 APIs that don’t properly verify who you are #2 • Weak/no token validation • Credential stuffing attacks #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Broken Authentication #1 Examples #2 • API accepts JWT without verifying the signature • Login endpoint allows unlimited password attempts #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Broken Authentication #1 ✔ Prevention #2 • Use established standards (OAuth 2.0, OpenID Connect) • Implement proper token validation and expiration • Rate limiting on auth endpoints #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

#1 #5 #2 #3 #4 #5 Broken Function Level Authorisation #6 Users can access functionality they shouldn’t #8 #7 #9 #10 Rob Allen ~ akrabat.com

Broken Function Level Authorisation #1 Users can access functionality they shouldn’t #2 • Incorrect authorisation check on a function or resource • Legitimate calls to endpoints that the user shouldn’t have access to • Undocumented open endpoints #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Broken Function Level Authorisation #1 Examples #2 • /debug/dump • Role unchecked #3 #4 #5 GET /users HTTP/1.1 Authorization: Bearer <regular user’s token> #6 #7 HTTP/1.1 200 OK #8 #9 #10 Rob Allen ~ akrabat.com

Broken Function Level Authorisation #1 ✔ Prevention #2 • Deny by default • Check roles/permissions on every endpoint • Don’t rely on hiding endpoints from documentation #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

#1 #1 #2 #3 #4 #5 Broken Object Level Authorisation #6 Users can access objects belonging to other users #8 #7 #9 #10 Rob Allen ~ akrabat.com

Broken Object Level Authorisation Users can access objects belonging to other users #1 #2 • User can access another user’s resource • Changing an ID or key allows access to privileged data #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Broken Object Level Authorisation Examples #1 #2 • /users/123/orders - change to 124 and see someone else’s orders #3 #4 GET /users/124/orders HTTP/1.1 Authorization: Bearer <token for user 123> #5 HTTP/1.1 200 OK #7 #6 • /accounts/1/documents/999 checks the account, but not the document #8 #9 #10 Rob Allen ~ akrabat.com

Broken Object Level Authorisation ✔ Prevention #1 #2 • Implement proper authorisation based on user policies • Check if the user has access to the requested resource • Check that the operation is also allowed #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

#1 #3 #2 #3 #4 #5 Broken Object Property Level Authorisation #6 Users can read or modify properties they shouldn’t #9 #7 #8 #10 Rob Allen ~ akrabat.com

Broken Object Property Level Authorisation #1 Users can read or modify properties they shouldn’t #3 #2 • Sending properties that this user shouldn’t see • Allowing this user to change a property they shouldn’t #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Broken Object Property Level Authorisation #1 Examples #3 #2 • Profile response includes PII that only admins should see • User updates profile #4 #5 #6 PATCH /users/123 HTTP/1.1 Content-Type: application/json #7 #8 {“name”: “Rob”, “role”: “admin”} #9 #10 Rob Allen ~ akrabat.com

Broken Object Property Level Authorisation #1 ✔ Prevention #3 #2 • Specifically choose object properties to return • Explicit allowlists for input properties #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Rob Allen ~ akrabat.com

Exploiting how your API works Business logic and resource abuse Rob Allen ~ akrabat.com

#1 #4 #2 #3 #4 #5 Unrestricted Resource Consumption #6 APIs that can be abused through resource consumption #8 #7 #9 #10 Rob Allen ~ akrabat.com

Unrestricted Resource Consumption #1 APIs that can be abused through resource consumption #2 • Expensive operations without throttling • Exhausting memory through requests for too much data • Denial of service #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Unrestricted Resource Consumption #1 Examples #2 • /widgets?page=1&per_page=1000000 • Resending an OTP; each SMS costs money #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Unrestricted Resource Consumption #1 ✔ Prevention #2 • Rate limiting (per IP, per user, per endpoint) • Pagination with maximum limits • Resource quotas / Timeouts #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

#1 #6 #2 #3 #4 #5 Unrestricted Access to Sensitive Business Flows #6 Critical workflows lack protection against automation #9 #7 #8 #10 Rob Allen ~ akrabat.com

Unrestricted Access to Sensitive Business Flows #1 Critical workflows lack protection against automation #3 #2 #4 • Legitimate calls, but unexpected order • Excessive access may harm the business #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Unrestricted Access to Sensitive Business Flows #1 Examples #3 #2 #4 • Ticket scalping bots • Inventory hoarding #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Unrestricted Access to Sensitive Business Flows #1 ✔ Prevention #3 #2 #4 • Device fingerprinting • Behavioural analysis • Transaction limits #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

#1 #10 #2 #3 #4 #5 Unsafe Consumption of APIs #6 Your API trusts third-party APIs too much #8 #7 #9 #10 Rob Allen ~ akrabat.com

Unsafe Consumption of APIs #1 Your API trusts third-party APIs too much #2 • Dependency on another’s vulnerabilities • Not accounting for failure #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Unsafe Consumption of APIs #1 Examples #2 • Synchronous Geolocation API times out • Third-party API redirects your request to an attacker’s host #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Unsafe Consumption of APIs #1 ✔ Prevention #2 • Validate all external data • Whitelist redirect URLs • Implement timeouts #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Rob Allen ~ akrabat.com

Operational security gaps Configuration and infrastructure vulnerabilities Rob Allen ~ akrabat.com

#1 #8 #2 #3 #4 #5 Security Misconfiguration #6 Insecure defaults and missing security hardening #8 #7 #9 #10 Rob Allen ~ akrabat.com

Security Misconfiguration #1 Insecure defaults and missing security hardening #2 • Default configurations • Missing security updates • Unnecessary features enabled #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Security Misconfiguration #1 Examples #2 • Error messages return stack traces • Public S3 buckets holding data backups or user uploads #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Security Misconfiguration #1 ✔ Prevention #2 • Regular security updates • Regular audits #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

#1 #9 #2 #3 #4 #5 Improper Inventory Management #6 Do you know your API? #8 #7 #9 #10 Rob Allen ~ akrabat.com

Improper Inventory Management #1 Do you know your API? #2 • Old API versions still running • Shadow APIs • Non-production environments accessible #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Improper Inventory Management #1 Examples #2 • v1 API wasn’t decommissioned • Staging environment is public #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Improper Inventory Management #1 ✔ Prevention #2 • Maintain API inventory/catalogue • Retire old versions with clear timelines #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

#1 #7 #2 #3 #4 #5 #6 Server Side Request Forgery #7 API fetches remote resources without validation #8 #9 #10 Rob Allen ~ akrabat.com

Server Side Request Forgery #1 API fetches remote resources without validation #2 • User-controlled URLs in API requests • API fetches a remote resource from a user-supplied URL #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

Server Side Request Forgery #1 Examples #2 • The API takes an internal URL; calls and returns it #3 #4 POST /avatar HTTP/1.1 Content-Type: application/json #5 #6 {“url” “http://127.0.0.1:8080/metrics” } #7 HTTP/1.1 200 OK Content-Type: text/plain #8 #9 process_cpu_seconds_total 4817.3 #10 Rob Allen ~ akrabat.com

Server Side Request Forgery #1 ✔ Prevention #2 • • • • Validate and sanitise URLs Whitelist for domains & media types, etc Disable HTTP redirection where possible Don’t send raw responses to clients #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

In closing Rob Allen ~ akrabat.com

OWASP API Security Top 10 Authentication & authorisation failures Business logic & resource abuse Configuration & infrastructure vulnerabilities #2 Broken Authentication #4 Unrestricted Resource Consumption #8 Security Misconfiguration #5 Broken Function Level Authorisation #1 Broken Object Level Authorisation #6 Unrestricted Access to Sensitive Business Flows #3 Broken Object Property Level Authorisation #10 Unsafe Consumption of APIs #9 Improper Inventory Management #7 Server Side Request Forgery Rob Allen ~ akrabat.com

Security requires • Defence in depth • Testing with the mindset of an attacker • Ongoing attention Rob Allen ~ akrabat.com

Resources OWASP API Security Project website https://owasp.org/projects/api-security-project REST Security Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html OWASP crAPI (Completely Ridiculous API) https://github.com/OWASP/crAPI Rob Allen ~ akrabat.com

Thank you! Rob Allen ~ akrabat.com