🔌 API Security
Protecting APIs with authentication, rate limiting, input validation, and defenses against the OWASP API Top 10 vulnerabilities.
APIs are the connective tissue of modern applications — and a primary attack vector. Over 80% of web traffic flows through APIs. As organizations adopt microservices and cloud-native architectures, the API attack surface expands dramatically.
📚 API Types & Categories — The Complete Reference
APIs are classified across three dimensions: who can access them, how they are architecturally designed, and how they communicate. Each dimension has direct security implications — knowing the type shapes the threat model.
Classification 1 — By Access (Who Can Call It?)
Classification 2 — By Architecture (How Is It Built?)
| Type | Style | Core Characteristics | Security Considerations | Best Used For |
|---|---|---|---|---|
| 🌐 REST | HTTP/CRUD | Stateless, resource-based URLs, standard HTTP verbs (GET/POST/PUT/DELETE). JSON/XML. Follows HTTP semantics. | ⚠️ OWASP API Top 10 fully applies. BOLA/IDOR on resource IDs. Missing auth on DELETE/PUT. Verbose error messages. | Web & mobile apps, public APIs, microservices, CRUD operations |
| 🏦 SOAP | XML/WS | XML-based, rigid contract (WSDL), built-in WS-Security standard. Stateful capable. Used in regulated industries. | ⚠️ XML injection, XXE (XML External Entity) attacks, SOAP action spoofing. WS-Security complex to implement correctly. | Banking, healthcare (HL7), government, legacy enterprise systems |
| 🔎 GraphQL | Query | Query language — clients specify exact data shape. Prevents over-fetching. Single endpoint. Strongly typed schema. | ⚠️ Introspection leaks full schema to attackers. Deeply nested queries can cause DoS. No built-in auth per field — developers must add manually. Batch query abuse. | Complex UIs with flexible data needs, BFF pattern, mobile apps reducing payload size |
| ⚡ gRPC | HTTP/2 | Google Remote Procedure Call. Uses Protocol Buffers (binary). HTTP/2 streaming. Low latency. Strongly typed contracts. | ⚠️ Binary format harder to inspect in WAF/logging. Requires TLS. Service-level auth needed (not just network-level). Less tooling maturity. | Internal microservices, real-time data, polyglot systems, high-performance inter-service calls |
| 📞 RPC | Legacy | Oldest pattern — calls remote procedures like local functions. Tightly coupled. XML-RPC and JSON-RPC variants. Direct method invocation model. | ⚠️ Lacks modern auth standards. Often no schema validation. Replay attacks. Tight coupling means changes ripple through systems. | Legacy systems, local network communication, blockchain node interfaces (JSON-RPC) |
| 🔄 WebSocket | Bi-directional | Full-duplex, persistent connection over a single TCP socket. Low latency. Server can push without client request. Upgrades from HTTP. | ⚠️ Auth happens only at handshake — once connected, continuous. Cross-site WebSocket hijacking (CSWSH). No built-in message-level auth. Hard to rate limit per message. | Live chat, real-time sports scores, financial tickers, collaborative editing, gaming |
Classification 3 — By Communication (How Does It Respond?)
API Security Architecture
Defense-in-Depth for APIs
Every layer adds a security control — no single point of failure
Key Concepts
🚪 API Gateway
Centralized entry point — auth, rate limiting, routing, SSL termination, logging
Tools: Kong, Apigee, AWS API Gateway🔑 OAuth 2.0 / OIDC
Standard authorization framework. Use Authorization Code + PKCE flow
Tools: Okta, Auth0, Keycloak⏱️ Rate Limiting
Prevent abuse via token bucket or sliding window algorithms
Tools: API Gateway rules, nginx limits✅ Input Validation
Validate all inputs against OpenAPI/Swagger schemas
Tools: JSON Schema, Joi, Zod🔍 API Discovery
Maintain inventory of all APIs — find shadow/deprecated endpoints
Tools: Salt Security, Traceable, Noname📡 API Monitoring & WAF
Real-time anomaly detection, bot mitigation, abuse patterns
Tools: AWS WAF, Cloudflare, Datadog🛡️ OWASP API Security Top 10 (2023)
The most critical API-specific vulnerabilities — from broken authorization to unsafe third-party consumption.
| ID | Vulnerability | Risk | Description | Key Mitigation |
|---|---|---|---|---|
| API1 | Broken Object Level Authorization | Critical | Manipulating IDs to access other users' data | Server-side auth per object, UUIDs |
| API2 | Broken Authentication | Critical | Weak auth mechanisms, missing token validation | OAuth 2.0/OIDC, short-lived tokens |
| API3 | Object Property Level Auth | High | Exposing/modifying restricted object properties | Explicit response schemas, allowlist fields |
| API4 | Unrestricted Resource Consumption | High | No rate limits → DoS or financial damage | Rate limiting, pagination, payload limits |
| API5 | Broken Function Level Auth | High | Regular users accessing admin endpoints | RBAC, deny by default, auth middleware |
| API6 | Unrestricted Sensitive Flows | Medium | Automated abuse of business-critical APIs | Bot detection, CAPTCHA, rate limiting |
| API7 | Server Side Request Forgery | High | Fetching attacker-controlled URLs | URL allowlisting, network segmentation |
| API8 | Security Misconfiguration | Medium | Missing headers, CORS misconfig, verbose errors | Hardening, automated config scanning |
| API9 | Improper Inventory Management | Medium | Shadow APIs, deprecated endpoints still live | API discovery tools, version management |
| API10 | Unsafe Consumption of APIs | Medium | Trusting third-party API data without validation | Validate all responses, circuit breakers |
Interview Preparation
What are the different types of APIs and their security implications?
APIs are classified 3 ways:
1BY ACCESS — Public (internet-facing, highest attack surface — OWASP API Top 10 fully applies), Private/Internal (insider threat, lateral movement risk — apply zero-trust/mTLS), Partner/B2B (third-party risk — scoped tokens + IP allowlisting), Composite (blast radius risk — one call exposes multiple services).
2BY ARCHITECTURE — REST (BOLA/IDOR on resource IDs), GraphQL (introspection leaks schema, deep query DoS — disable introspection in prod), gRPC (binary format evades WAF — need gRPC-aware proxy), SOAP (XXE attacks via XML), WebSocket (auth only at handshake — CSWSH risk).
3BY COMMUNICATION — Synchronous (connection exhaustion attacks, timeout mishandling), Asynchronous/WebHooks (HMAC signature validation critical — anyone can POST to webhook URL without it).
How do you prevent Broken Object Level Authorization (BOLA)?
BOLA (also called IDOR) occurs when the API doesn't verify that the authenticated user has permission to access the requested object. Mitigations:
1Implement authorization checks on every object access — don't rely on obscurity of IDs.
2Use UUIDs instead of sequential IDs (defense in depth, not primary control).
3Check object ownership: if(object.userId !== currentUser.id) deny.
4Log and alert on authorization failures.
5Write automated tests for authorization.
6Use API gateway policies for object-level enforcement.
How would you design a secure API authentication architecture?
1) Use OAuth 2.0 with Authorization Code + PKCE flow (not implicit).
2JWTs for stateless auth with short expiry (15 min) and refresh tokens.
3API keys only for server-to-server, never exposed client-side.
4Mutual TLS (mTLS) for internal service mesh communication.
5Rate limit auth endpoints aggressively.
6Implement account lockout and CAPTCHA for brute force.
7Use API gateway as centralized auth enforcement point.
8Rotate credentials regularly and monitor for leaked tokens.
Framework Mapping
| Framework | Relevant Controls |
|---|---|
| OWASP | API Security Top 10 (2023), API Security Testing Guide |
| NIST | SP 800-53 AC-3 (Access Enforcement), IA-8 (Identification), SC-13 (Crypto) |
