APIs are the backbone of modern applications — connecting mobile apps to backends, integrating third-party services, and powering microservices architectures. They are also a growing attack target. Gartner predicted that APIs would become the most-attacked surface, and that prediction has proven accurate. Insecure APIs expose sensitive data, enable account takeover, and provide entry points for broader attacks.
Common API Vulnerabilities
Broken authentication: APIs that allow brute-force attacks, use weak tokens, or fail to validate token expiry. Without proper authentication, anyone can access your API endpoints.
Broken object-level authorisation (BOLA): The most common API vulnerability. An API that lets User A access User B’s data by simply changing the ID in the request. Example: changing /api/orders/123 to /api/orders/124 and seeing another customer’s order.
Excessive data exposure: APIs that return more data than the client needs, relying on the frontend to filter. An API returning full user profiles (including email, phone, address) when the client only needs the display name.
Lack of rate limiting: APIs without rate limits are vulnerable to brute-force attacks, credential stuffing, and denial of service. An attacker can send millions of requests to enumerate data or overwhelm your system.
Injection: SQL injection, NoSQL injection, and command injection through API parameters. If input is not validated and sanitised, attackers can execute arbitrary queries or commands.
Authentication Best Practices
Use industry-standard protocols — OAuth 2.0 for authorisation, OpenID Connect for authentication, and JWT (JSON Web Tokens) for stateless token-based authentication. Implement short-lived access tokens with longer-lived refresh tokens. Never include secrets in query parameters (they appear in server logs). Use API keys for service-to-service authentication and rotate them regularly.
Authorisation Controls
Every API endpoint must enforce authorisation — verify that the authenticated user has permission to access the specific resource they are requesting. Implement object-level authorisation checks, not just authentication checks. Use role-based access control (RBAC) or attribute-based access control (ABAC). Test authorisation by attempting to access resources belonging to different users and roles.
Input Validation
Validate all input — type, length, format, and range. Use an API schema (OpenAPI/Swagger) to define expected inputs and validate requests against it. Reject requests that do not match the schema. Sanitise inputs to prevent injection attacks. Never trust client-side validation — always validate on the server.
Rate Limiting and Throttling
Implement rate limiting on all endpoints. Set different limits based on the endpoint’s sensitivity and expected usage patterns. Authentication endpoints (login, password reset) should have aggressive limits. Use sliding window algorithms for smoother rate limiting. Return informative 429 (Too Many Requests) responses with Retry-After headers.
Data Minimisation
Return only the data the client needs. Do not return entire database objects — use response schemas to explicitly define what fields are included. Never expose internal IDs, database column names, or infrastructure details in API responses.
Monitoring and Logging
Log all API requests — who made the request, what they requested, and the response status. Monitor for anomalies: unusual request volumes, failed authentication attempts, access pattern changes, and requests for non-existent endpoints. Set up alerts for potential attacks and investigate promptly. Use an API gateway for centralised logging, rate limiting, and security policy enforcement.
API Security Testing
Include API security testing in your development lifecycle. Use automated tools (OWASP ZAP, Burp Suite) for vulnerability scanning. Conduct manual penetration testing focused on API-specific vulnerabilities. Test authorisation boundaries rigorously. Include API security in code reviews. Maintain an inventory of all APIs — you cannot secure APIs you do not know about.
