Skip to main content

About API

APIs, or Application Programming Interfaces, are tools that allow different software applications to talk to each other. Think of an API as a waiter in a restaurant. You (the client) place an order, the waiter (the API) takes it to the kitchen (the server), and then brings your food (the response) back to you. This is how APIs work — they help send requests and deliver responses between systems.

APIs are everywhere. Whether you're using a mobile app, browsing a website, or talking to a smart device, you're probably using an API without even realizing it. APIs help apps share information, connect with databases, and perform functions like logging in, making a payment, or fetching user data.

Types of Web APIs​

There are different ways to build APIs, and each one has its own style and purpose:

  • REST (Representational State Transfer): The most popular style. It uses standard web methods like GET (to read), POST (to add), PUT (to update), and DELETE (to remove data). REST APIs are easy to use and usually send data in JSON format.
  • SOAP (Simple Object Access Protocol): A more complex style that uses XML for communication. It’s strict and secure, often used in big companies for critical systems.
  • GraphQL: A modern and flexible way to request only the data you need. Instead of getting too much or too little data, you ask for exactly what you want.
  • gRPC: A high-performance style used in large systems where speed and efficiency are very important. It uses a special format called Protocol Buffers.

Why Securing APIs Is Important​

APIs are powerful tools, but they can also create risks. Since APIs allow systems to connect and share data, a poorly protected API can be a target for attackers. If an API isn’t built securely, it might leak private information, allow unauthorized access, or crash from too many requests.

That’s why API security is so important — especially in today's world, where almost every app and service relies on APIs.

OWASP Top 10 API Security Risks​

Reference: https://owasp.org/www-project-api-security/

To help developers and security professionals understand the biggest risks in APIs, the OWASP (Open Worldwide Application Security Project) created a list called the OWASP API Security Top 10 2023. It highlights the most common and dangerous API vulnerabilities.

Here’s a simple explanation of each one:

  1. API1: Broken Object Level Authorization
    Users can access or modify other users’ data (like viewing someone else's profile or account).
  2. API2: Broken Authentication
    Weak or flawed login systems let attackers pretend to be someone else.
  3. API3: Broken Object Property Level Authorization
    APIs expose or allow changes to sensitive parts of data that users shouldn’t access.
  4. API4: Unrestricted Resource Consumption
    APIs don’t have limits, so attackers can overload the system and cause slowdowns or crashes.
  5. API5: Broken Function Level Authorization
    Users can access functions or features they’re not supposed to use (like deleting someone else’s data).
  6. API6: Unrestricted Access to Sensitive Business Flows
    APIs reveal important business functions that can be misused or abused (like skipping a payment step).
  7. API7: Server Side Request Forgery (SSRF)
    Attackers use the API to send malicious requests inside the system or to other systems.
  8. API8: Security Misconfiguration
    Mistakes in API settings leave the system open to attacks like injection or data leaks.
  9. API9: Improper Inventory Management
    Old or untracked APIs are still active and can be discovered and exploited by attackers.
  10. API10: Unsafe Consumption of APIs
    APIs trust other APIs too much, and if those other APIs are insecure, it creates new risks.

Conclusion​

APIs are essential for modern apps, but they must be secure. Understanding how APIs work and where they can go wrong helps developers build safer, more reliable applications. By learning about the OWASP API Top 10, we can spot common mistakes and defend against real-world threats.