Vulnerabilities versus abuse cases

While the discussion so far has focused on vulnerabilities (flaws in software that can be exploited by an attacker), we need to also consider the impact of API abuse on API security. API abuse is generally defined as the use of an API in an unexpected way, leading to negative consequences. Normally, an API is designed to support a mobile application or website; however, since the API is exposed, curious users or adversaries can reverse-engineer the API and use it for their own purposes.

An excellent example comes from the supermarket industry in the United Kingdom during the first Covid-19 lockdown. Supermarket delivery services rapidly became oversubscribed, and supermarkets quickly implemented limiting controls on the web frontends to avoid total overload and failure. Curious developers quickly examined the APIs and found endpoints that allowed access to the booking system and were able to reserve precious delivery slots by bypassing the frontend...