My Skill Lab
CybersecurityIntermediate

API Security

OWASP API Top 10, auth, rate limiting and testing your endpoints.

Taught by Kiran Basnet · Security Engineer

What you'll learn

  • Map an API's attack surface and classify findings with the OWASP API Security Top 10 (2023)
  • Find and fix BOLA/IDOR and function-level authorisation flaws with server-side checks
  • Validate JWT and OAuth access tokens correctly and avoid common authentication mistakes
  • Prevent mass assignment and data over-exposure with strict request and response schemas
  • Configure rate limits, quotas and payload limits that stop abuse without breaking clients
  • Test endpoints for authorisation and input flaws using Postman, Burp Suite and schema-driven tools

About this course

APIs now carry most of the traffic behind web and mobile apps, which makes them a favourite target for attackers. This intermediate API security course is for backend developers, QA engineers, penetration testers and security analysts who want to find and fix the flaws that matter. You will work through the OWASP API Security Top 10 (2023) with real code, starting with broken object level authorisation (BOLA, also called IDOR), then authentication and JWT mistakes, broken function level authorisation, mass assignment and excessive data exposure. You will add rate limiting and resource controls, validate requests against an OpenAPI schema, place an API gateway in front of your services and finish by testing endpoints with Postman and Burp Suite. Examples use Python with FastAPI and Pydantic, plus nginx and standard HTTP tooling. You should be comfortable building or calling a REST API and reading basic Python.

Course content

7 lessons
  1. 1Why APIs Are the Top Attack SurfaceHow modern apps expose APIs, why attackers target them, and a tour of the OWASP API Security Top 10.Preview
  2. 2Broken Object Level Authorisation (BOLA/IDOR)The most common API flaw: letting any user fetch any object by changing an ID, and how to fix it.
  3. 3Authentication Flaws, Tokens and Function-Level AccessAPI keys, OAuth tokens and JWTs done right, plus stopping ordinary users from calling admin functions.
  4. 4Mass Assignment and Excessive Data ExposureStop clients writing fields they should not, and APIs returning fields nobody should see.
  5. 5Rate Limiting and Resource ConsumptionProtect APIs from brute force, scraping and cost blow-ups with rate limits, quotas and payload caps.
  6. 6API Gateways, Schemas and Defence in DepthUse gateways, OpenAPI contracts, inventory and SSRF controls to secure APIs consistently at scale.
  7. 7Testing Your APIs with Postman and Burp SuiteA practical API testing workflow: collections, two-user authorisation tests, Burp Repeater and automation.