Summary

At this point, you have the high-level information required to understand and communicate API security. You know that a secure API begins with a thoughtful design. You also know that thinking about API security requires a holistic view of how consumers interact with your implementation. API security is as much about authentication as it is about testing and being updated about the current vulnerabilities. You know about OWASP and how to find reported security vulnerabilities as they’re discovered. You also know that a fine-grained authorization system is an excellent measure to mitigate security risks. Finally, you know how to combine the different security components to offer a successful API product.

This chapter began by identifying the key areas of API security. You learned about the OWASP “Security Top 10” list and how to be on top of newly discovered vulnerabilities. You then learned about API security testing methodologies, including SAST, DAST...