OWASP API Security Top 10

When to Read Which Reference

Quick Patterns

• Enforce object-level and function-level authorization on every API request; never trust client-supplied IDs without server-side checks.
• Validate and sanitize all inputs; treat third-party API responses as untrusted.
• Apply rate limiting, quotas, and cost controls to prevent abuse and DoS.
• Maintain an API inventory; retire or protect deprecated and debug endpoints.

Quick Reference / Examples

@app.get("/api/orders/{order_id}")
def get_order(order_id: int, current_user: User):
    order = Order.query.get(order_id)
    if order.user_id != current_user.id:
        raise HTTPException(403, "Access denied")
    return order

@app.get("/api/orders/{order_id}")
def get_order(order_id: int):
    return Order.query.get(order_id)  # Any user can access any order!

from slowapi import Limiter
limiter = Limiter(key_func=get_remote_address)

@app.get("/api/search")
@limiter.limit("10/minute")
def search(query: str):
    return perform_search(query)

Workflow

1. Object-level authorization (IDOR) → Read references/api1-broken-object-level-authorization.md.
2. Authentication and tokens → Read references/api2-broken-authentication.md.
3. Rate limiting / DoS → Read references/api4-unrestricted-resource-consumption.md.
4. Admin vs user endpoints → Read references/api5-broken-function-level-authorization.md.
5. User-supplied URLs in API → Read references/api7-ssrf.md.
6. Third-party API consumption → Read references/api10-unsafe-consumption-of-apis.md.