The OWASP API Security Top 10 classes
You recognise every class in the OWASP API Security Top 10 in the code, traffic and logs of a mobile app back end, fix them and bring version and inventory management into order.
Level 301 · 15 lessons · 13 practice labs
Lessons
Authorisation classes
- Broken object level authorisation (BOLA)
- Broken authentication: token, password and key mistakes
- Broken object property level authorisation
- Broken function level authorisation
- Short task: evidence four authorisation flaws in the lab API
Resource and flow classes
- Unrestricted resource consumption: paging, size and cost
- Unrestricted access to sensitive business flows: bots and automation
- SSRF in APIs: endpoints that take URLs
- Blindly trusting third-party APIs
- Short task: set limits against resource exhaustion and flow abuse
Configuration and inventory
- Security misconfiguration: CORS, debug and defaults
- Improper inventory management: old versions and test environments
- Retiring and deprecating versions
- Monitoring API abuse per key, user and endpoint
- Capstone: audit and fix a mobile app back end against all ten classes
Practice labs
- Find and add the missing authorisation check in this API: Find the endpoint in the mobile back end that returns another user's notifications and add object-level authorisation.
- A hidden field in the response: is_admin: Find the is_admin field returned in the profile response and accepted on update and add property-level authorisation.
- An admin function a user can call: Find the endpoint that skips the role check when called with DELETE and apply function-level authorisation to every method.
- An authentication flaw in token refresh: Prove the refresh endpoint accepts revoked tokens and add a revocation check and rotation.
- Four authorisation classes, four fixes: Find one flaw from each of the four authorisation classes in the lab API, close them and write an automated test for each.
- An endpoint that accepts unlimited file size: Show the profile picture endpoint processes very large bodies and add size and time limits.
- Cost on the verification code endpoint: Prove the SMS verification code request can be repeated without limit and set quotas per user and per number.
- A purchase flow where a bot drains stock: Show in the lab that automation drains a limited-stock product and add a per-account limit and a waiting step to the flow.
- Blind trust in a third-party API response: Show the response from the mock shipping API is processed unchecked and add schema validation and a timeout.
- A debug endpoint left on in production: Find the debug endpoint that dumps environment variables and disable it in the production configuration.
- A staging copy exposed with real data: Prove the weakly protected staging API reaches real data and separate the environment and restrict access.
- Retire v1: Show a flaw closed in the new version persists in v1 and apply a deprecation header, monitoring and a shutdown plan for v1.
- Abuse monitoring per key: Build a query and alert from gateway logs that show abnormal use per key, user and endpoint.
About this course
You recognise every class in the OWASP API Security Top 10 in the code, traffic and logs of a mobile app back end, fix them and bring version and inventory management into order.
What you will learn
- Authorisation classes
- Resource and flow classes
- Configuration and inventory
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.