English
Español
Cybersecurity
Development7 min read
OWASP API Top 10: The vulnerabilities that destroy your backend.
APIs are the new attack surface
APIs are no longer auxiliary infrastructure — they are the core of digital businesses. Your mobile app, e-commerce, B2B integrations, and cloud architecture all communicate via APIs. And attackers know it perfectly.
The OWASP API Security Top 10 documents the most critical categories. Understanding them is the first step to not becoming the next victim.
The most critical vulnerabilities
API1:2023
BOLA — Broken Object Level Authorization
The attacker manipulates an ID in the URL to access another user's data. Affects 72% of analysed APIs. Authorisation must be validated per resource, not just by role.
API2:2023
Broken Authentication
JWT tokens without expiry, weak secrets, missing MFA, or endpoints without rate limiting. Enables session hijacking and undetected brute force.
API3:2023
Broken Object Property Authorization
The API returns or accepts fields the user should not see or modify (mass assignment). Attackers send extra fields to escalate privileges.
API4:2023
Unrestricted Resource Consumption
Without limits on requests, payload size, or query complexity, an attacker can degrade the service without needing a massive DDoS.
Config: Rate Limiting + JWT in NGINX Plus
This excerpt requires the commercial NGINX Plus JWT module. The key file must contain a JSON Web Key Set (JWKS), not a PEM public key. Send the token in the Authorization: Bearer header; putting it in a URL can expose it in logs. See the NGINX JWT documentation and RFC 6750 token transport guidance.
Place this excerpt inside the http context and configure your TLS certificate and backend upstream separately. Validate the issuer, audience and resource permissions for your application before production use: token validation does not replace authorisation checks.
# NGINX Plus — excerpt inside http { ... }
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
server {
listen 443 ssl;
# TLS certificate and backend upstream configured separately.
# Reads Authorization: Bearer by default.
auth_jwt "API Zone";
auth_jwt_key_file /etc/nginx/api-jwks.json;
location /api/ {
limit_req zone=api burst=10 nodelay;
limit_req_status 429;
add_header X-Content-Type-Options "nosniff";
add_header Strict-Transport-Security "max-age=31536000";
add_header X-Frame-Options "DENY";
proxy_pass http://backend;
}
}
"An API without authentication is a back door with a welcome sign. Without rate limiting, it is an open invitation to abuse."
Zenith — Primitive Security
API security checklist
- 01
Authentication — JWT with short expiry, rotating refresh tokens, MFA on critical endpoints.
- 02
Authorisation — Validate BOLA on every resource. Principle of least privilege per token/scope.
- 03
Input validation — Strict schema validation. Reject requests with unexpected fields.
- 04
Rate limiting — Per IP, per user, and per endpoint. 429 response with Retry-After header.
- 05
Logging — Record all requests with IP, user-agent and user. Alert on anomalous patterns.
Tags :
OWASPAPIsJWTDevSecOpsBackend
