REST API security fundamentals
You read a REST API’s endpoints and OpenAPI definition, recognise core mistakes such as object-level authorisation and excessive data exposure with Burp, fix them in code and watch for them in gateway logs.
Level 201 · 15 lessons · 13 practice labs
Lessons
Getting to know the API
- REST basics: resources, methods and status codes
- Reading an OpenAPI definition: endpoints, schemas and security schemes
- Inspecting API traffic with Burp and Postman
- API inventory: versions, shadow and forgotten endpoints
- Short task: build an inventory of the lab API’s endpoints
Identity and authority
- API keys and bearer tokens: differences and risks
- Object-level authorisation: an ownership check on every record
- Endpoints that accept extra fields and schema-bound input
- Responses that return more data than needed
- Short task: find and fix the endpoint that returns another user’s order
Resilience and monitoring
- Rate limits and quotas: preventing resource exhaustion
- Schema validation and content-type checks
- Internal details leaking in error responses
- API gateway logs and abnormal usage
- Capstone: audit, fix and retest an order API
Practice labs
- A risk list from an OpenAPI file: Read the lab API's OpenAPI file and mark endpoints that need no authentication and return sensitive data.
- A shadow endpoint: missing from the docs, present in traffic: Compare the gateway log with the docs to find an undocumented endpoint and apply the decision to remove or document it.
- A forgotten version in a Postman collection: Find an old API version that still works in a shared request collection and carry out the retirement steps.
- Endpoint inventory and risk ranking: Inventory every endpoint of the fictional Selvara Market API by version, authorisation and data sensitivity and fix the top three risks.
- An endpoint that returns someone else's order: Prove /orders/{id} returns another user's order and add the ownership check.
- A user list that returns too much: Show the user list response returns emails, phone numbers and internal notes and narrow it with a role-based schema.
- A product update that accepts extra fields: Prove stock and approval fields added to a product update are accepted and add schema-bound input validation.
- API key versus bearer token: Show an endpoint acting on a user's behalf works with only an app key and require a user token.
- Authorisation on a nested resource: basket items: Prove the parent resource is checked but the child is not on /baskets/{id}/items and add ownership at both levels.
- A stack trace in an error response: Find the stack trace returned when invalid JSON is sent and replace it with a generic error body.
- No page size limit: Prove a very large limit value returns the whole table and add a maximum and mandatory pagination.
- Rate limit and quota at the gateway: Define a per-key rate limit and daily quota at the gateway and show a client over the limit gets 429.
- Abnormal API use in the gateway log: Find a key harvesting data with sequential IDs in the gateway log and write an alert rule that catches the pattern.
About this course
You read a REST API’s endpoints and OpenAPI definition, recognise core mistakes such as object-level authorisation and excessive data exposure with Burp, fix them in code and watch for them in gateway logs.
What you will learn
- Getting to know the API
- Identity and authority
- Resilience and monitoring
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.