API security · 3 min read
Five API mistakes I find in almost every assessment
Five findings appear so consistently that I now test for them in the first hour of any API engagement. Each has a one-paragraph fix.
API security
API Security Articles
What this covers
These posts cover API security testing and design: authorisation enforced per object rather than per screen, token lifetime and revocation, mass assignment, rate limiting on the endpoints that matter, and keeping an inventory of what is actually routable.
An API does not know what the client renders. Every control that matters has to be enforced server side, per request, per object — and the findings below are what happens when that assumption slips, one endpoint at a time.
3 posts in API security.
API security · 4 min read
JWTs are not sessions: token handling mistakes in mobile backends
A JWT is a signed claim, not a session. Treating it as one produces tokens nobody can revoke and a logout button that logs nobody out.
API security · 3 min read
Rate limiting that actually stops OTP abuse
A four-digit OTP with a per-IP limit is not protected. It is protected against one attacker on one connection, which is not the attacker you have.
Want this tested properly?
Scope and a fixed quote within two working days. First consultation is free.