From the course: CompTIA SecurityX (CAS-005) Cert Prep

Unlock this course with a free trial

Join today to access over 24,300 courses taught by industry experts.

API security

API security

From the course: CompTIA SecurityX (CAS-005) Cert Prep

Start my 1-month free trial Buy for my team

API security

“

- In this web safari, we're going to dive into API security and pretty much the defacto standard for securing application programming interfaces, whether they be WebSocket, whether they be RESTful, or Google's GRPC would be OWASP, okay? So let's go ahead and take a look at the OWASP top 10 for APIs. And this is 2023 version, so a little sneak peek. We'll go through these. There's 10 of 'em. So first we have broken object level authorization. APIs tend to expose endpoints that handle object identifiers. This is a wide attack surface for object level access control issues. So this authorization check is considered important in every function that accesses a data source using an ID from the user. Then we have broken authentication. Authentication mechanisms are often implemented incorrectly. This gives attackers the ability to compromise authentication tokens or exploit implementation flaws. Next, we have number three, broken object property level authorization. This combines a couple…

Contents