API's Dark Side: Addressing AppSec's Biggest Challenge

The talk starts from the shift in how modern applications are built. Clients now exchange raw JSON with servers that act mainly as data proxies, and the logic runs in the client. Every endpoint adds to the attack surface, and APIs are easy to spin up, so forgotten or undocumented ones often remain exposed. The speaker argues that classic flaws such as SQL injection are becoming less common, while API-specific weaknesses are growing.

The middle of the talk walks through the OWASP API Security Top 10, which the speaker helped create. Broken authentication comes from missing protections such as brute-force defenses, or from weak implementations like misused JWTs and unsalted passwords. Broken object-level and function-level authorization are presented as the core access control failures, with examples of users reaching other users' objects or calling admin functions. Excessive data exposure happens when apps filter sensitive fields on the client instead of the server, and a dating app case showed hidden fields leaking. Mass assignment lets an attacker set privileged properties such as a role. The remaining categories cover missing rate limits, security misconfiguration, and improper asset management, including legacy or beta API versions that were never documented or protected.

The closing message is that access control is the central challenge and must be designed in from the start. Practitioners should keep an inventory of APIs, document them, and retire unused versions, and they should scrutinize third-party APIs as carefully as open-source dependencies. The speaker also noted that the list is being updated to cover formats such as GraphQL.