api-security-checklist

# API Security Checklist Comprehensive, actionable checklist for passive API security scanning. All checks are non-destructive and safe for production environments. Replace `TARGET` with the actual target domain (no trailing slash). --- ## 1. Endpoint Discovery How to find API endpoints: - Analyze JS bundles with Playwright: search for URL patterns (`/api/`, `/v1/`, `/graphql`, fetch/axios calls) - Check network requests via Playwright `browser_network_requests` - Probe common API paths: ```bash for path in /api /api/v1 /api/v2 /graphql /swagger.json /swagger-ui.html /openapi.json /api-docs /api-docs.json /.well-known/openid-configuration /health /status /metrics /actuator; do code=$(curl -sI "https://TARGET${path}" -o /dev/null -w "%{http_code}") echo "$code $path" done ``` Playwright snippet for JS endpoint extraction: ```javascript // Collect fetch/axios calls from JS bundles const scripts = Array.from(document.querySelectorAll('script')); const inlineCode = scripts.filter(s => !s.src).map(s => s.textContent).join('\n'); const apiPatterns = inlineCode.match(/["'](\/api\/[^"']+|\/v[0-9]+\/[^"']+|\/graphql[^"']*)/g); ``` --- ## 2. CORS Analysis Test CORS configuration: ```bash # Test with arbitrary origin curl -sI -H "Origin: https://evil.com" https://TARGET/api/ | grep -i "access-control" # Test with null origin curl -sI -H "Origin: null" https://TARGET/api/ | grep -i "access-control" ``` Misconfigurations to flag: - `Access-Control-Allow-Origin: *` with ...