OWASP API Security list
If you aren’t a security testing expert, it can be hard to know what kinds of things to look for in security testing. One great place to start is with the OWASP API Security top 10 list (https://owasp.org/www-project-api-security/). I won’t go through every item on the list, but let’s go through a few of them to see how we might approach testing for them.
Authorization and authentication
Many items on that list have to do with authorization and authentication. Of course, this makes sense, since authorization and authentication are at the core of any security strategy, but what kind of things can you check for to see if there might be weaknesses in your API’s authentication and authorization approaches?
Let’s start by looking at risk factors that could contribute to hackers getting through the authentication. Authentication is one of the first places for hackers to try, since users need to authenticate to get into...
