Summary

This has been a key chapter in your journey in learning how to defend APIs from attacks. The key learning point is that while the attack vectors are vast and varied, there are well-established patterns for defending APIs against common vulnerabilities.

Firstly, we examined how to deal with common authentication vulnerabilities, focusing on best practices for handling JWTs securely, using OAuth2 securely, and securing your passwords, tokens, and reset process. Whilst the recommendations are extensive, developers will benefit from following these guidelines to avoid some of the most nefarious authentication vulnerabilities. Secondly, authorization of your APIs poses significant challenges, and in this chapter, we learned how to address both object-level and function-level vulnerabilities through the judicious usage of authorization middleware to bolster your defenses.

Thirdly, we dealt with the critical vulnerabilities associated with API data, namely excessive data exposure...