Authorization vulnerabilities

Now that we have covered how to secure your API authentication, we focus on its counterpart – authorization. We will cover patterns for protecting against object-level and function-level vulnerabilities and how to apply various authorization middleware to improve overall authorization robustness and extensibility.

Object-level vulnerabilities

In Chapter 3, Understanding Common API Vulnerabilities, we covered the root causes of broken object-level vulnerabilities in the API1:2019 – Broken object-level authorization section. As a reminder, this vulnerability originates when an API grants access to an object (typically data) not owned by the calling user or client.

Despite its prevalence and reputation as the most serious of API vulnerabilities, broken object-level authorization is paradoxically one of the easiest vulnerabilities to address as a defender. The rule is simple – always explicitly validate the access to an object...