English
Español
Development7 min read
OWASP API Top 10: The vulnerabilities that destroy your backend.
APIs are the new attack surface
APIs are no longer auxiliary infrastructure — they are the core of digital businesses. Your mobile app, e-commerce, B2B integrations, and cloud architecture all communicate via APIs. And attackers know it perfectly.
The OWASP API Security Top 10 documents the most critical categories. Understanding them is the first step to not becoming the next victim.
The most critical vulnerabilities
API1:2023
BOLA — Broken Object Level Authorization
The attacker manipulates an ID in the URL to access another user's data. Affects 72% of analysed APIs. Authorisation must be validated per resource, not just by role.
API2:2023
Broken Authentication
JWT tokens without expiry, weak secrets, missing MFA, or endpoints without rate limiting. Enables session hijacking and undetected brute force.
API3:2023
Broken Object Property Authorization
The API returns or accepts fields the user should not see or modify (mass assignment). Attackers send extra fields to escalate privileges.
API4:2023
Unrestricted Resource Consumption
Without limits on requests, payload size, or query complexity, an attacker can degrade the service without needing a massive DDoS.
Config: Rate Limiting + JWT in NGINX
The first line of API defence is rate limiting and token validation at the network edge, before the request reaches the backend.
# NGINX — Rate Limiting + JWT Auth + Security Headers
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
server {
listen 443 ssl http2;
auth_jwt "API Zone" token=$arg_token;
auth_jwt_key_file /etc/nginx/jwt-public.pem;
location /api/ {
limit_req zone=api burst=10 nodelay;
limit_req_status 429;
add_header X-Content-Type-Options "nosniff";
add_header Strict-Transport-Security "max-age=31536000";
add_header X-Frame-Options "DENY";
proxy_pass http://backend;
}
}
"An API without authentication is a back door with a welcome sign. Without rate limiting, it is an open invitation to abuse."
Zenith — Primitive Security
API security checklist
- 01
Authentication — JWT with short expiry, rotating refresh tokens, MFA on critical endpoints.
- 02
Authorisation — Validate BOLA on every resource. Principle of least privilege per token/scope.
- 03
Input validation — Strict schema validation. Reject requests with unexpected fields.
- 04
Rate limiting — Per IP, per user, and per endpoint. 429 response with Retry-After header.
- 05
Logging — Record all requests with IP, user-agent and user. Alert on anomalous patterns.
