Sign in Get started

API Security in Depth · Capstone

Capstone: Review an API Design

Perform a security design review of a proposed ride-sharing API.

Scenario

A team proposes: GET /v1/rides/{rideId} (returns rider and driver name, phone, live location), PATCH /v1/users/{userId} (accepts a full user JSON), POST /v1/promo/redeem (no limits), GET /v1/drivers/nearby?lat=&lng=&radius= (radius unbounded, returns driver IDs and exact positions), JWTs valid for 30 days stored in mobile local storage, and an /internal/payouts endpoint on the same public gateway "protected because it isn't documented".

Requirements

  • Identify risks mapped to OWASP API Top 10
  • Propose concrete fixes
  • Prioritize

Constraints

  • Launch in 6 weeks

Deliverables

  1. List the findings with OWASP categories and severity.
  2. Propose fixes and a 6-week plan.

Draft each deliverable below before revealing the model answer and rubric.

Further reading: OWASP API Security Top 10 2023

Deliverables

List the findings with OWASP categories and severity.

Model answer

  1. /rides/{id}: BOLA risk (must verify caller is rider/driver of that ride) + excessive exposure of phone numbers (API1/API3) — Critical. 2) PATCH /users/{id}: BOLA on userId (use /me) + mass assignment (API1/API3) — Critical. 3) /internal/payouts on public gateway: BFLA + inventory (API5/API9) — Critical. 4) Promo redeem without limits: business-flow abuse (API6) — High. 5) drivers/nearby unbounded radius + exact positions: resource consumption + privacy/tracking (API4/API3) — High. 6) 30-day JWTs in local storage: broken authentication (API2) — High.

Rubric

Strong answers map each issue to a category and rank by impact; missing the phone-number exposure or internal endpoint is a common miss.

Propose fixes and a 6-week plan.

Model answer

Week 1–2: ownership checks + DTOs; /me endpoints; masked phone numbers via proxy calling; move payouts to internal network with service auth. Week 3: auth code + PKCE, 10-min access tokens, rotating refresh tokens in Keychain/Keystore. Week 4: promo limits per user/device/payment instrument, attestation signal; nearby radius cap, coarse/jittered positions, rate limit. Week 5–6: authorization matrix tests in CI, ZAP + Schemathesis on staging, logging/detections.

Rubric

Look for fixes that reduce data exposure (masking, coarse location) and for automated tests to prevent regressions.

Open in the app to mark lessons complete, take notes and track your progress.