OWASP API Security Top 10

OWASP API Top 10 — engineer map

Risk	Plain language	Fix
Broken object level AuthZ	IDOR	Check resource ownership
Broken AuthZ	Admin functions exposed	Role + permission checks
Broken object property level	Mass assignment	Allowlist fields on PATCH
Unrestricted resource consumption	No rate limits	429, quotas, pagination caps
Broken function level AuthZ	DELETE /admin open	AuthZ on every route
Unrestricted access to sensitive flow	No MFA on password change	Step-up auth
SSRF	Server fetches attacker URL	URL validation, network policy
Security misconfiguration	Debug on in prod	Hardening checklist
Improper inventory	Shadow APIs	Gateway catalog
Unsafe consumption of APIs	Trusting third-party JSON	Validate external payloads

Excessive data exposure

Return only fields client needs. GET /user shouldn't include password_hash, internal flags.

GraphQL: field-level authZ on resolvers (Communication → GraphQL).

Rate limiting & abuse

Per IP, per API key, per user. Exponential backoff on 429.

Communication covers rate limit headers; Microservices → Gateway implements edge limits.

Webhook security

HMAC signature on raw body, timestamp replay window (Communication → Webhooks).

Error handling

Production errors: generic message + request_id. No stack traces, no SQL errors to client.

Log details server-side only (Observability → Logging — don't log secrets).

gRPC specifics

• Metadata for auth tokens
• Max message size limits
• Reflection disabled in prod

Cross-reference: Databases → SQL — parameterized queries for injection; theory not repeated here.