The Attack Surface Raised to the Power of the Web

The web moved from HTML pages to JSON APIs, and so did the attackers. APIs multiply the blast radius of every classic web vulnerability — one endpoint that misses an authorization check now returns thousands of records, and every microservice is a new reachable attack surface, often exposed directly to the internet. The OWASP API Top 10 is the standard map; this lesson walks the entries plus the defenses.

BOLA and BFLA: Object and Function-Level Authorization

The number-one API flaw: broken object level authorization, where an endpoint trusts object IDs from the request (GET /api/orders/1942) without checking ownership — the IDOR lesson, but central, because APIs hand out object references by design. Broken function level authorization sits on top: admin endpoints reachable by any authenticated client. The fix is per-object ownership checks and role gates applied centrally — and tested from multiple roles in CI.

Broken Authentication and Excessive Data Exposure

APIs are where authentication gets reinvented badly: API keys sent in query strings (they leak into logs), expired tokens still honored, weak password reset flows, and missing rate limits enable credential stuffing. Excessive data exposure is the new head of the hydra: the API simply returns the full record (SELECT *) and the client filters the sensitive fields out of sight — so the data is fully exposed, just not displayed. APIs should serialize a precise DTO per endpoint (the auth-concepts least-privilege rule applied to output) and never echo secrets or internal notes the consuming app does not use.

Mass Assignment, Injection, and Improper Asset Management

Mass assignment: an endpoint that maps the whole JSON body onto the model lets a client set is_admin=true or owner_id=1 — accept explicit allowlists of fields per action. Injection: the same SQL/NoSQL/command injection lessons apply to JSON, and NoSQL databases are especially notorious for operator injection ({"$ne": ""} bypassing logins) because the injection is a datatype, not a string. Improper asset management: staging environments and accidental /v1/ and /v2/ mirrors left publicly reachable — an inventory (the supply-chain lesson) of every exposed host is the start, and often the top finding.

The Defense Layers

Tie the layers together: an API gateway or middleware enforcing auth, rate limits and allowlisted methods; per-route schema validation that rejects unknown fields (kills mass assignment and CORS abuse); structured logging of who hit which endpoint (the incident-response feed); and versioned endpoints that deprecate cleanly instead of remaining reachable forever. For sensitive APIs, use short-lived scoped tokens instead of long-lived master keys, and consider mTLS for machine-to-machine traffic where the client must prove who it is with a certificate of its own. The review practice that catches most of this: for each endpoint, write the matrix — who may call it, with which role, against which object — then run the app against it as the wrong user and confirm the denial. Automate that matrix in CI with contract tests that assert the exact response shape and status per role, because the moment an endpoint starts echoing a new column or skipping a check, a passing test suite is the difference between a quiet drift and a public data exposure.