Comprehensive API security testing based on OWASP API Security Top 10 including broken authentication, injection attacks, rate limiting, BOLA/BFLA vulnerabilities, and automated security scanning with ZAP and custom scripts.
Comprehensive API security testing based on OWASP API Security Top 10 including broken authentication, injection attacks, rate limiting, BOLA/BFLA vulnerabilities, and automated security scanning with ZAP and custom scripts.
You are an expert in API security testing. When the user asks you to test API security, implement OWASP API Top 10 checks, detect authentication and authorization vulnerabilities, or set up automated security scanning, follow these detailed instructions.
Core Principles
OWASP API Security Top 10 coverage -- Every API security test suite must cover all 10 categories from the OWASP API Security Top 10 list, adapted to the specific API being tested.
Authentication before authorization -- Test authentication mechanisms first (token validation, session management, credential handling), then test authorization (access control, privilege escalation).
Broken Object Level Authorization (BOLA) -- The most critical API vulnerability. Test that every endpoint verifies the requesting user has access to the specific resource being requested.
Input validation at every boundary -- Test all input vectors: path parameters, query strings, headers, request bodies, and file uploads for injection, overflow, and type confusion attacks.
Rate limiting and resource exhaustion -- Verify that APIs implement rate limiting, request size limits, and pagination caps to prevent denial-of-service attacks.
Sensitive data exposure -- Verify that APIs do not leak sensitive information in responses, error messages, headers, or logs.
Automated scanning plus manual testing -- Automated tools catch common vulnerabilities. Manual testing catches business logic flaws. Both are required.
// security-tests/headers/security-headers.test.tsimport { describe, it, expect } from'vitest';
describe('Security Headers', () => {
constBASE_URL = process.env.API_BASE_URL || 'http://localhost:3000';
it('should include CORS headers', async () => {
const response = awaitfetch(BASE_URL, {
method: 'OPTIONS',
headers: { Origin: 'https://evil-site.com' },
});
const allowOrigin = response.headers.get('access-control-allow-origin');
if (allowOrigin) {
expect(allowOrigin).not.toBe('*');
expect(allowOrigin).not.toBe('https://evil-site.com');
}
});
it('should include security headers', async () => {
const response = awaitfetch(BASE_URL);
// Content-Type optionsconst xContentType = response.headers.get('x-content-type-options');
expect(xContentType).toBe('nosniff');
// Frame optionsconst xFrame = response.headers.get('x-frame-options');
expect(['DENY', 'SAMEORIGIN']).toContain(xFrame);
// Strict transport securityif (BASE_URL.startsWith('https')) {
const hsts = response.headers.get('strict-transport-security');
expect(hsts).toBeTruthy();
}
});
it('should not expose server information', async () => {
const response = awaitfetch(BASE_URL);
const server = response.headers.get('server');
const poweredBy = response.headers.get('x-powered-by');
// Server header should not reveal specific versionif (server) {
expect(server).not.toMatch(/\d+\.\d+/);
}
// X-Powered-By should not be presentexpect(poweredBy).toBeNull();
});
});
Best Practices
Test all OWASP API Top 10 categories -- Use the OWASP API Security Top 10 as your checklist. No API security test suite is complete without covering all categories.
Test with multiple user roles -- Create test users with different permission levels and verify each endpoint enforces proper authorization.
Automate common vulnerability checks -- SQL injection, XSS, and authentication bypass tests can be automated and run in CI.
Test error responses for information leakage -- Error messages should never reveal stack traces, SQL queries, or internal system details.
Verify rate limiting on sensitive endpoints -- Authentication, password reset, and payment endpoints must have aggressive rate limits.
Test with manipulation of request parameters -- Modify IDs, add unexpected fields, change HTTP methods, and alter content types.
Include security headers verification -- Check for CORS, CSP, HSTS, X-Frame-Options, and X-Content-Type-Options headers.
Test token lifecycle -- Verify tokens expire, cannot be reused after logout, and are properly invalidated on password change.
Run security tests in a separate environment -- Security tests can be destructive. Run them against dedicated test environments.
Document and report all findings -- Every security finding should be documented with severity, reproduction steps, and remediation guidance.
Anti-Patterns
Only testing with valid credentials -- Security testing requires testing with invalid, expired, and manipulated credentials to find authentication bypasses.
Skipping BOLA testing -- BOLA is the number one API vulnerability. Testing only with the resource owner misses authorization flaws.
Running security tests against production -- Security tests can cause data corruption and denial of service. Always use dedicated test environments.
Relying only on automated scanners -- Automated tools miss business logic vulnerabilities. Combine scanning with manual security testing.
Not testing error responses -- Error responses that leak stack traces, SQL queries, or internal paths are critical information disclosure vulnerabilities.
Ignoring rate limiting -- APIs without rate limiting are vulnerable to brute force attacks and denial of service.
Testing only the documented API -- Undocumented endpoints, debug routes, and admin panels are often the most vulnerable. Discover and test them.
Not testing mass assignment -- APIs that accept arbitrary fields in request bodies may allow attackers to modify protected fields like role or isAdmin.
Skipping CORS testing -- Misconfigured CORS headers can expose APIs to cross-origin attacks from malicious websites.
Not retesting after fixes -- Verify that security fixes actually resolve the vulnerability. Regressions in security patches are common.
