# data[].attributes.blurb.html
APIs are the foundation of our applications today and need to be secure. From broken authorisation and authentication to injection attacks, the OWASP API Security Top 10 identifies the most critical security issues facing APIs today. In this talk, we’ll walk through the items on the list and explore these security flaws and look at how to prevent them. By the end of this session, you’ll have a clear understanding of the most critical API security risks and be equipped with the knowledge to build more secure APIs.

# data[].attributes.slidedeck.data[].slides[].desc.html
Securing Your API: The OWASP API Top 10 Rob Allen, May 2026

# data[].attributes.slidedeck.data[].slides[].desc.html
57 % of organizations suffered an API-related data breach in the past two years Traceable 2025 Global State of API Security report Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Why APIs are different? Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
The OWASP API Security Project seeks to provide value to software developers and security assessors by underscoring the potential risks in insecure APIs Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
OWASP API Security Top 10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
OWASP API Security Top 10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Who are you and what can you access? Authentication and authorisation failures Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Authentication APIs that don’t properly verify who you are #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Authentication APIs that don’t properly verify who you are • Weak/no token validation • Missing expiration on tokens • Credential stuffing attacks #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Authentication #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 APIs that don’t properly verify who you are • Weak/no token validation • Missing expiration on tokens • Credential stuffing attacks Example: API accepts JWT without verifying the signature Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Authentication Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Authentication Prevention • Use established standards (OAuth 2.0, OpenID Connect) • Implement proper token validation and expiration • Rate limiting on auth endpoints #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Function Level Authorisation Users can access functionality they shouldn’t #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Function Level Authorisation Users can access functionality they shouldn’t • Incorrect authorisation checked on a function or resource • Legitimate calls to endpoints that the user shouldn’t have access to • Undocumented open endpoints #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Function Level Authorisation Users can access functionality they shouldn’t • Incorrect authorisation checked on a function or resource • Legitimate calls to endpoints that the user shouldn’t have access to • Undocumented open endpoints #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: /debug/dump Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Function Level Authorisation Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Function Level Authorisation Prevention • Deny by default • Check roles/permissions on every endpoint • Don’t rely on hiding endpoints from documentation #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Level Authorisation Users can access objects belonging to other users #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Level Authorisation Users can access objects belonging to other users • User can access another user’s resource • Changing an ID or key allows access to privileged data #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Level Authorisation Users can access objects belonging to other users • User can access another user’s resource • Changing an ID or key allows access to privileged data #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example:/users/123/orders - change to 124 and see someone else’s orders Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Level Authorisation Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Level Authorisation Prevention • Implement proper authorisation based on user policies • Check if the user has access the requested resource • Check that the operation is also allowed #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Property Authorisation Users can read or modify properties they shouldn’t #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Property Authorisation Users can read or modify properties they shouldn’t • Sending properties that this user shouldn’t see • Allowing this user to change a property they shouldnt #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Property Authorisation Users can read or modify properties they shouldn’t • Sending properties that this user shouldn’t see • Allowing this user to change a property they shouldnt #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: User updates profile, includes “role”: “admin” in payload Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Property Authorisation Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Broken Object Property Authorisation Prevention • Cherry pick object properties to return • Explicit allowlists for input properties #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Exploiting how your API works Business logic and resource abuse Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted resource consumption APIs that can be abused through resource consumption #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted resource consumption APIs that can be abused through resource consumption • Expensive operations without throttling • Exhausting memory through requests for too much data • Denial of service #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted resource consumption APIs that can be abused through resource consumption • Expensive operations without throttling • Exhausting memory through requests for too much data • Denial of service #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: /widgets?page=1&per_page=1000000 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted resource consumption Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted resource consumption Prevention • Rate limiting (per IP, per user, per endpoint) • Pagination with maximum limits • Resource quotas / Timeouts #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted access to business flows Critical workflows lack protection against automation #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted access to business flows Critical workflows lack protection against automation • Some business flows are more sensitive than others • Legitimate calls, but unexpected order” • Excessive access may harm the business #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted access to business flows Critical workflows lack protection against automation • Some business flows are more sensitive than others • Legitimate calls, but unexpected order” • Excessive access may harm the business #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: Ticket scalping bots, inventory hoarding Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted access to business flows Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unrestricted access to business flows Prevention • Device fingerprinting • Behavioral analysis • Transaction limits #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unsafe consumption of APIs Your API trusts third-party APIs too much #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unsafe consumption of APIs Your API trusts third-party APIs too much • Dependency on another’s vulnerabilities • Malicious data can be injected • Not accounting for failure #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unsafe consumption of APIs Your API trusts third-party APIs too much • Dependency on another’s vulnerabilities • Malicious data can be injected • Not accounting for failure #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: Geolocation API takes 30 seconds to time out and locks your API Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unsafe consumption of APIs Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Unsafe consumption of APIs Prevention • Validate all external data • Whitelist redirect URLs • Implement timeouts #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Operational security gaps Configuration and infrastructure vulnerabilities Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Security misconfiguration Insecure defaults and missing security hardening #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Security misconfiguration Insecure defaults and missing security hardening • • • • Default configurations Missing security updates Unnecessary features enabled Header misconfiguration (CORS, etc.) #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Security misconfiguration Insecure defaults and missing security hardening • • • • Default configurations Missing security updates Unnecessary features enabled Header misconfiguration (CORS, etc.) #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: Error messages return stack traces Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Security misconfiguration Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Security misconfiguration Prevention • Regular security auditing and updates • Audit and remove unnecessary features • For APIs against browser-based clients, implement CORS security headers #1 #2 #3 #4 #5 #6 #7 #8 #9 and#10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Improper inventory management Do you know your API? #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Improper inventory management Do you know your API? • Old API versions still running • Shadow APIs (undocumented endpoints) • Non-production environments accessible #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Improper inventory management Do you know your API? • Old API versions still running • Shadow APIs (undocumented endpoints) • Non-production environments accessible #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: v1 API wasn’t decommissioned Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Improper inventory management Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Improper inventory management Prevention • Maintain API inventory/catalog • API Gateway / automated discovery tools • Retire old versions with clear timelines #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Server side request forgery API fetches remote resources without validation #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Server side request forgery API fetches remote resources without validation • User-controlled URLs in API requests • API fetches a remote resource from user-supplied URL • Can access internal network endpoints #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Server side request forgery API fetches remote resources without validation • User-controlled URLs in API requests • API fetches a remote resource from user-supplied URL • Can access internal network endpoints #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Example: /images?url=http://127.0.0.1:8080/metrics Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Server side request forgery Prevention #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Server side request forgery Prevention • • • • Validate and sanitize URLs Whitelist for domains & media types, etc Disable HTTP redirection where possible Don’t sent raw responses to clients #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
In Closing Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
OWASP API Security Top 10 • Authentication & authorisation failures • Business logic & resource abuse • Configuration & infrastructure vulnerabilities Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Security requires • Defense in depth • Testing with the mindset of an attacker • Ongoing attention Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Resources OWASP API Security Project website owasp.org/www-project-api-security/ REST Security Cheat Sheet cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html API Security news apisecurity.io Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
“Securing APIs isn’t optional; it is the frontline defense for protecting data integrity and maintaining digital trust.” Randy Barr, Cequence Security Rob Allen ~ akrabat.com

# data[].attributes.slidedeck.data[].slides[].desc.html
Thank you! slides: https://akrabat.com/7561 feedback: https://grusp.org/agenda Rob Allen ~ akrabat.com