OWASP API Security Top 10
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
recognize the most common API weaknesses.
Planned topics
- BOLA (broken object-level authorization):
GET /orders/42returns someone else's order. Check ownership on every object access. - Broken authentication, and broken object property-level authorization (mass assignment, excessive data exposure).
- Broken function-level authorization: a normal user calls an admin endpoint.
- Unrestricted resource consumption: no rate, size, or pagination limits.
- Also: unrestricted access to sensitive business flows, SSRF, misconfiguration, poor API inventory, unsafe consumption of third-party APIs. Verify the current list edition before recording.
Draft outline details
Demonstration
Order o = repo.findById(id).orElseThrow();
if (!o.customerId().equals(principal.customerId())) throw new NotFoundException();Check your understanding
What is BOLA?
Show answer
Accessing another user's object by changing its ID because ownership is not checked.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.