Sign in Get started

API Security in Depth · Capstone

Capstone: Secure a Multi-Tenant B2B API

Design authentication, authorization and abuse controls for an invoicing platform.

Scenario

An invoicing SaaS serves 3,000 business tenants. It has a web app (SPA), a mobile app, a public REST API for customers' ERP integrations, outbound webhooks, an "import invoice from URL" feature, and an internal admin console. A pentest found: invoices of other tenants readable by changing the ID, users able to set role via profile update, and /v1 still running without the rate limits added to /v2.

Requirements

  • Fix the pentest findings structurally
  • Choose credentials for SPA, mobile, ERP integrations and internal services
  • Prevent SSRF in URL import
  • Detect and respond to abuse

Constraints

  • ERP customers need simple setup
  • Some enterprise customers require mTLS
  • Small security team

Deliverables

  1. Design authentication and credentials for each client type.
  2. Fix BOLA, BOPLA and inventory issues structurally and prove it.
  3. Secure URL import and webhooks; define detections.

Hints

  • Use the OWASP API Top 10 as a checklist for coverage.
  • Fix classes of bugs, not instances.
  • Think about the tenant boundary at every layer.

Draft each deliverable below before revealing the model answer and rubric.

Further reading: OWASP API Security Top 10 2023

Deliverables

Design authentication and credentials for each client type.

Model answer

SPA: auth code + PKCE via a BFF holding tokens server-side (HttpOnly session cookie, SameSite=Lax/Strict + CSRF protection). Mobile: auth code + PKCE in system browser, short access tokens, rotating refresh tokens in Keychain/Keystore. ERP: API keys with sk_live_ prefix, hashed, scoped, multiple active keys for rotation; OAuth client credentials with private_key_jwt or mTLS-bound tokens for enterprise. Internal services: workload identity (mesh mTLS/SPIFFE) + service tokens with audience checks. Admin console: separate host, SSO + phishing-resistant MFA, IP restrictions.

Rubric

Strong answers match credentials to client capabilities (public vs confidential), cover rotation and storage, and isolate admin. Misses: API keys in mobile apps; no rotation story.

Fix BOLA, BOPLA and inventory issues structurally and prove it.

Model answer

Tenant-scoped repositories (every query filters by tenant from the token) + Postgres RLS as defense in depth; 404 for foreign objects. Input DTOs with extra=forbid; output DTOs per role. Authorization matrix tests generated from OpenAPI (cross-tenant, role × route) in CI; route-policy coverage test. Inventory: catalog with owners/lifecycle; apply security middleware at the gateway for all versions; announce /v1 Sunset, monitor usage, retire.

Rubric

Look for structural fixes (not just patching three handlers) and automated regression tests.

Secure URL import and webhooks; define detections.

Model answer

URL import: https only, DNS resolve + block private/link-local/metadata ranges (v4/v6), pin IP, no redirects, 10 s timeout, 10 MB cap, content-type checks, isolated egress proxy, IMDSv2. Webhooks out: Standard Webhooks signatures, per-tenant secrets with rotation, SSRF checks on registered endpoints. Detections: per-principal 403/404 spikes, key used from new countries, export volume anomalies, failed-login spikes; runbooks for key leaks.

Rubric

Strong answers handle DNS rebinding and redirects, and connect detections to responses.

Open in the app to mark lessons complete, take notes and track your progress.