Sign in Get started

Free course · 20 lessons · Advanced

API Security in Depth

The OWASP API Security Top 10 (2023) in practice: BOLA, BOPLA, BFLA, OAuth 2.1 and RFC 9700, token validation, fine-grained authorization, API keys, mTLS and DPoP, resource limits, business-flow abuse, SSRF, misconfiguration, inventory, webhooks, security testing and detection.

Start the course

1. API Threat Landscape & Object-Level Risks

OWASP API Top 10 2023, threat modeling, BOLA and BOPLA.

  1. The OWASP API Security Top 10 (2023) — The ten most common API risks and how they differ from classic web risks.
  2. Threat Modeling an API — STRIDE per endpoint, trust boundaries and abuse cases.
  3. Broken Object Level Authorization (BOLA) — The #1 API risk: checking that the caller may access this specific object.
  4. Object Property Level Authorization: Mass Assignment & Data Exposure — Control which fields each caller may read and write.

2. Authentication & Authorization for APIs

OAuth 2.1 and the security BCP, tokens, scopes, keys and mTLS.

  1. OAuth 2.1 & the OAuth Security BCP (RFC 9700) — What changed: PKCE everywhere, no implicit or password grants, exact redirects.
  2. Validating Access Tokens Correctly — JWT verification, opaque tokens and introspection.
  3. Scopes, Roles & Fine-Grained Authorization — Coarse scopes in tokens, fine-grained decisions in a policy layer.
  4. API Keys Done Right — Identification, hashing, prefixes, scopes and rotation.
  5. mTLS & Sender-Constrained Tokens (DPoP) — Binding credentials to a key so stolen tokens are useless.

3. Function Authorization, Abuse & SSRF

Admin functions, resource limits, business-flow abuse and server-side requests.

  1. Broken Function Level Authorization — Deny-by-default route permissions and hidden admin endpoints.
  2. Unrestricted Resource Consumption — Limits on size, rate, complexity, time — and money.
  3. Sensitive Business Flows & Bot Abuse — Scalping, fake signups, credential stuffing and referral fraud.
  4. Server-Side Request Forgery (SSRF) — When your API fetches URLs on a user's behalf.

4. Configuration, Inventory & Secure Operations

Hardening, API inventory, third-party APIs, testing and detection.

  1. Security Misconfiguration: TLS, CORS, Headers & Errors — Hardened defaults for every API deployment.
  2. API Inventory & Lifecycle Security — Know every API, version, environment and data flow you expose.
  3. Unsafe Consumption of APIs & Webhook Security — Treat third-party APIs and inbound webhooks as untrusted input.
  4. Security Testing APIs in CI — SAST, dependency scanning, DAST, fuzzing and authorization tests.
  5. Security Logging, Detection & Incident Response — Audit trails, detections and what to do when a key leaks.

5. Capstone

Threat-model and secure a multi-tenant B2B API.

  1. Capstone: Secure a Multi-Tenant B2B API — Design authentication, authorization and abuse controls for an invoicing platform.
  2. Capstone: Review an API Design — Perform a security design review of a proposed ride-sharing API.