api-securitylisted

# API Security Web-app and API security overlap but are not the same. APIs ship with different defaults (CORS-permissive, no CSRF tokens, often no rate-limiting), different consumers (mobile apps, integrations, scripts — not just browsers), and a different attack surface (object IDs in URLs, JSON bodies, scoped tokens). The **OWASP API Security Top 10 (2023 edition)** is the canonical reference; this skill walks each item with concrete detection and fix patterns. ## When to invoke - Designing a new REST or GraphQL API - Reviewing an existing API before scaling user count - After abuse — scraping, account takeover, suspicious 4xx/5xx patterns - Adding a public-facing endpoint to a previously internal service - An API is feeding a mobile or single-page app where the client cannot be trusted - Periodic API audit (quarterly is reasonable) ## API01:2023 — Broken Object Level Authorization (BOLA) **The #1 API vulnerability and not even close.** Every endpoint that takes an ID and returns the corresponding resource must check the caller is allowed to see *that specific* object. ```ts // Bad — any authenticated user reads any invoice app.get('/api/invoices/:id', requireAuth, async (req, res) => { const invoice = await db.invoices.findUnique({ where: { id: req.params.id }}); res.json(invoice); }); // Good — scoped to the requester's ownership app.get('/api/invoices/:id', requireAuth, async (req, res) => { const invoice = await db.invoices.findFirst({ where: { id: req.