API Security · 2023 edition
A focused OWASP Top 10 for API-first systems, covering authorization, authentication, resource abuse, inventory hygiene, and third-party API trust boundaries.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 | Broken Object Level Authorization | APIs expose object identifiers and allow unauthorized access when object-level authorization checks are missing. | Details |
| 02 | Broken User Authentication | Weak token/session handling allows attackers to impersonate users or hijack API sessions. | Details |
| 03 | Excessive Data Exposure | APIs return more fields than needed, leaking sensitive data through overbroad responses. | Details |
| 04 | Lack of Resources and Rate Limiting | Missing quotas and limits enables denial of service, brute force, and cost-amplification abuse. | Details |
| 05 | Broken Function Level Authorization | Privileged API functions are reachable without proper role or policy checks. | Details |
| 06 | Mass Assignment | Attackers inject unexpected object properties when APIs bind request bodies too broadly. | Details |
| 07 | Security Misconfiguration | Unsafe defaults, exposed debug features, and weak hardening create avoidable attack paths. | Details |
| 08 | Injection | Untrusted API input is interpreted as commands or queries, enabling injection attacks. | Details |
| 09 | Improper Assets Management | Undocumented, stale, or shadow APIs increase attack surface and weaken governance. | Details |
| 10 | Insufficient Logging and Monitoring | Security incidents remain undetected when API events are not logged and alerted properly. | Details |
