Securing Your API: The OWASP API Top 10
A presentation at Nordic APIs Summit 2026 in in Stockholm, Sweden by Rob Allen
Securing your API: The OWASP API Top 10 Rob Allen, October 2026
57% of organizations suffered an API-related data breach in the past two years Traceable 2025 Global State of API Security report Rob Allen ~ akrabat.com
OWASP API Security Top 10 Rob Allen ~ akrabat.com
Who are you and what can you access? Authentication and authorisation failures Rob Allen ~ akrabat.com
#1 #2 #2 #3 #4 #5 Broken Authentication #6 APIs that don’t properly verify who you are #8 #7 #9 #10 Rob Allen ~ akrabat.com
Broken Authentication #1 APIs that don’t properly verify who you are #2 • Weak/no token validation • Credential stuffing attacks #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Broken Authentication #1 Examples #2 • API accepts JWT without verifying the signature • Login endpoint allows unlimited password attempts #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Broken Authentication #1 ✔ Prevention #2 • Use established standards (OAuth 2.0, OpenID Connect) • Implement proper token validation and expiration • Rate limiting on auth endpoints #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
#1 #5 #2 #3 #4 #5 Broken Function Level Authorisation #6 Users can access functionality they shouldn’t #8 #7 #9 #10 Rob Allen ~ akrabat.com
Broken Function Level Authorisation #1 Users can access functionality they shouldn’t #2 • Incorrect authorisation check on a function or resource • Legitimate calls to endpoints that the user shouldn’t have access to • Undocumented open endpoints #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Broken Function Level Authorisation #1 Examples #2 • /debug/dump • Role unchecked #3 #4 #5 GET /users HTTP/1.1 Authorization: Bearer <regular user’s token> #6 #7 HTTP/1.1 200 OK #8 #9 #10 Rob Allen ~ akrabat.com
Broken Function Level Authorisation #1 ✔ Prevention #2 • Deny by default • Check roles/permissions on every endpoint • Don’t rely on hiding endpoints from documentation #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
#1 #1 #2 #3 #4 #5 Broken Object Level Authorisation #6 Users can access objects belonging to other users #8 #7 #9 #10 Rob Allen ~ akrabat.com
Broken Object Level Authorisation Users can access objects belonging to other users #1 #2 • User can access another user’s resource • Changing an ID or key allows access to privileged data #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Broken Object Level Authorisation Examples #1 #2 • /users/123/orders - change to 124 and see someone else’s orders #3 #4 GET /users/124/orders HTTP/1.1 Authorization: Bearer <token for user 123> #5 HTTP/1.1 200 OK #7 #6 • /accounts/1/documents/999 checks the account, but not the document #8 #9 #10 Rob Allen ~ akrabat.com
Broken Object Level Authorisation ✔ Prevention #1 #2 • Implement proper authorisation based on user policies • Check if the user has access to the requested resource • Check that the operation is also allowed #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
#1 #3 #2 #3 #4 #5 Broken Object Property Level Authorisation #6 Users can read or modify properties they shouldn’t #9 #7 #8 #10 Rob Allen ~ akrabat.com
Broken Object Property Level Authorisation #1 Users can read or modify properties they shouldn’t #3 #2 • Sending properties that this user shouldn’t see • Allowing this user to change a property they shouldn’t #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Broken Object Property Level Authorisation #1 Examples #3 #2 • Profile response includes PII that only admins should see • User updates profile #4 #5 #6 PATCH /users/123 HTTP/1.1 Content-Type: application/json #7 #8 {“name”: “Rob”, “role”: “admin”} #9 #10 Rob Allen ~ akrabat.com
Broken Object Property Level Authorisation #1 ✔ Prevention #3 #2 • Specifically choose object properties to return • Explicit allowlists for input properties #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Rob Allen ~ akrabat.com
Exploiting how your API works Business logic and resource abuse Rob Allen ~ akrabat.com
#1 #4 #2 #3 #4 #5 Unrestricted Resource Consumption #6 APIs that can be abused through resource consumption #8 #7 #9 #10 Rob Allen ~ akrabat.com
Unrestricted Resource Consumption #1 APIs that can be abused through resource consumption #2 • Expensive operations without throttling • Exhausting memory through requests for too much data • Denial of service #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Unrestricted Resource Consumption #1 Examples #2 • /widgets?page=1&per_page=1000000 • Resending an OTP; each SMS costs money #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Unrestricted Resource Consumption #1 ✔ Prevention #2 • Rate limiting (per IP, per user, per endpoint) • Pagination with maximum limits • Resource quotas / Timeouts #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
#1 #6 #2 #3 #4 #5 Unrestricted Access to Sensitive Business Flows #6 Critical workflows lack protection against automation #9 #7 #8 #10 Rob Allen ~ akrabat.com
Unrestricted Access to Sensitive Business Flows #1 Critical workflows lack protection against automation #3 #2 #4 • Legitimate calls, but unexpected order • Excessive access may harm the business #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Unrestricted Access to Sensitive Business Flows #1 Examples #3 #2 #4 • Ticket scalping bots • Inventory hoarding #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Unrestricted Access to Sensitive Business Flows #1 ✔ Prevention #3 #2 #4 • Device fingerprinting • Behavioural analysis • Transaction limits #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
#1 #10 #2 #3 #4 #5 Unsafe Consumption of APIs #6 Your API trusts third-party APIs too much #8 #7 #9 #10 Rob Allen ~ akrabat.com
Unsafe Consumption of APIs #1 Your API trusts third-party APIs too much #2 • Dependency on another’s vulnerabilities • Not accounting for failure #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Unsafe Consumption of APIs #1 Examples #2 • Synchronous Geolocation API times out • Third-party API redirects your request to an attacker’s host #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Unsafe Consumption of APIs #1 ✔ Prevention #2 • Validate all external data • Whitelist redirect URLs • Implement timeouts #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Rob Allen ~ akrabat.com
Operational security gaps Configuration and infrastructure vulnerabilities Rob Allen ~ akrabat.com
#1 #8 #2 #3 #4 #5 Security Misconfiguration #6 Insecure defaults and missing security hardening #8 #7 #9 #10 Rob Allen ~ akrabat.com
Security Misconfiguration #1 Insecure defaults and missing security hardening #2 • Default configurations • Missing security updates • Unnecessary features enabled #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Security Misconfiguration #1 Examples #2 • Error messages return stack traces • Public S3 buckets holding data backups or user uploads #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Security Misconfiguration #1 ✔ Prevention #2 • Regular security updates • Regular audits #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
#1 #9 #2 #3 #4 #5 Improper Inventory Management #6 Do you know your API? #8 #7 #9 #10 Rob Allen ~ akrabat.com
Improper Inventory Management #1 Do you know your API? #2 • Old API versions still running • Shadow APIs • Non-production environments accessible #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Improper Inventory Management #1 Examples #2 • v1 API wasn’t decommissioned • Staging environment is public #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Improper Inventory Management #1 ✔ Prevention #2 • Maintain API inventory/catalogue • Retire old versions with clear timelines #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
#1 #7 #2 #3 #4 #5 #6 Server Side Request Forgery #7 API fetches remote resources without validation #8 #9 #10 Rob Allen ~ akrabat.com
Server Side Request Forgery #1 API fetches remote resources without validation #2 • User-controlled URLs in API requests • API fetches a remote resource from a user-supplied URL #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
Server Side Request Forgery #1 Examples #2 • The API takes an internal URL; calls and returns it #3 #4 POST /avatar HTTP/1.1 Content-Type: application/json #5 #6 {“url” “http://127.0.0.1:8080/metrics” } #7 HTTP/1.1 200 OK Content-Type: text/plain #8 #9 process_cpu_seconds_total 4817.3 #10 Rob Allen ~ akrabat.com
Server Side Request Forgery #1 ✔ Prevention #2 • • • • Validate and sanitise URLs Whitelist for domains & media types, etc Disable HTTP redirection where possible Don’t send raw responses to clients #3 #4 #5 #6 #7 #8 #9 #10 Rob Allen ~ akrabat.com
In closing Rob Allen ~ akrabat.com
OWASP API Security Top 10 Authentication & authorisation failures Business logic & resource abuse Configuration & infrastructure vulnerabilities #2 Broken Authentication #4 Unrestricted Resource Consumption #8 Security Misconfiguration #5 Broken Function Level Authorisation #1 Broken Object Level Authorisation #6 Unrestricted Access to Sensitive Business Flows #3 Broken Object Property Level Authorisation #10 Unsafe Consumption of APIs #9 Improper Inventory Management #7 Server Side Request Forgery Rob Allen ~ akrabat.com
Security requires • Defence in depth • Testing with the mindset of an attacker • Ongoing attention Rob Allen ~ akrabat.com
Resources OWASP API Security Project website https://owasp.org/projects/api-security-project REST Security Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html OWASP crAPI (Completely Ridiculous API) https://github.com/OWASP/crAPI Rob Allen ~ akrabat.com
Thank you! Rob Allen ~ akrabat.com
APIs are the foundation of our applications today and need to be secure. From broken authorisation and authentication to injection attacks, the OWASP API Security Top 10 identifies the most critical security issues facing APIs today. In this talk, we’ll walk through the items on the list and explore these security flaws and look at how to prevent them. By the end of this session, you’ll have a clear understanding of the most critical API security risks and be equipped with the knowledge to build more secure APIs.
