APIs Are the New Front Door
According to Salt Security's 2025 State of API Security Report, API-related security incidents increased 681% over three years, with 94% of organisations experiencing an API security incident. Akamai reports API attacks represent over 30% of all web application attacks.
OWASP API Security Top 10
API1: Broken Object Level Authorisation (BOLA)
The most common API vulnerability. Always verify the authenticated user is authorised to access the specific object. Use PostgreSQL Row-Level Security for defence in depth in multi-tenant applications.
API2: Broken Authentication
Use OAuth 2.0/OIDC with established identity providers. Short-lived access tokens (15-60 minutes). Always validate JWT signatures, expiration, issuer, audience. Rate limit login endpoints.
API3: Broken Object Property Level Authorisation
Never return internal fields to clients (role, isAdmin, passwordHash). Whitelist accepted fields on updates to prevent mass assignment attacks.
API4: Unrestricted Resource Consumption
Implement per-user and per-IP rate limiting. Set maximum request body size. Enforce pagination with maximum page size. For GraphQL: query depth limiting and complexity scoring.
Authentication Patterns
- API Keys — For server-to-server. Transmit in headers, never URLs. Hash in storage. Support key rotation.
- OAuth 2.0 with JWT — Standard for user-facing APIs. Validate signatures against JWKS endpoint. Use RS256 algorithm.
- Mutual TLS (mTLS) — For high-security service-to-service. Common in financial services and healthcare.
Input Validation
Use JSON Schema or Zod (TypeScript) for request body validation. Always use parameterised queries — never interpolate user input into SQL. Validate all inputs: headers, path parameters, query strings, and bodies.
Monitoring and Incident Detection
Monitor: authentication failure spikes (credential stuffing), authorisation failures (BOLA attacks), unusual data volumes (exfiltration), geographic anomalies, and scraping patterns. Tools: AWS WAF, Salt Security/42Crunch for runtime API security, API Gateway access logging.
API Security Checklist
- Authentication on every endpoint
- Object-level authorisation checks
- Input validation with schema enforcement
- Rate limiting per user and per IP
- Response filtering — never expose internal fields
- HTTPS only with HSTS headers
- CORS configured for your domains only
- Security headers (CSP, X-Content-Type-Options, X-Frame-Options)
- Dependency scanning in CI/CD
- Access logging and anomaly alerting
Our development teams build security into every layer. For comprehensive assessment, our technical due diligence service includes detailed API security auditing. Contact us to get started.
