When applications trust third-party API responses without sufficient validation, upstream compromise or malformed data can cascade into downstream security incidents. Attackers abuse weak trust boundaries through manipulated payloads, dependency compromise, or protocol edge cases. This turns integration points into systemic risk multipliers.
Treat third-party responses as untrusted input: validate schemas, apply strict contracts, and sanitize before use. Isolate integrations, enforce timeout and retry policies, and limit blast radius with circuit breakers and fallback strategies. Continuously monitor supplier security posture and dependency integrity.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2023Latest
#10api10-2023 Unsafe Consumption of APIs
