Thinking like an attacker

The most powerful piece of advice I could offer any API builder or defender is to think like an attacker. As discussed in the opening section, developers may not have a perspective on or insight into how an attacker can exploit an API. Unfortunately, as we have seen in Chapter 4, Case Studies of Recent Breaches, it is all too easy to become the victim of an API attack.

So, where does a developer start on their journey toward building more secure APIs?

• Equip yourself with a toolbox and set of resources: By far the most comprehensive list of API-security resources is the Awesome API Security GitHub repository: https://github.com/arainho/awesome-api-security.
• Start with learning material: There are great tutorials on YouTube, and an API-security course is even available for free online. OWASP as always is a fantastic reference.
• Test your own APIs: Use Postman and/or the reverse proxy tool to interact with your own APIs. Try to do things in...