Awesome API Security Essentials
🚀 About the Project
As more applications rely on APIs for communication and data exchange, ensuring their security is crucial to prevent unauthorized access, data breaches, and service disruptions. The "Awesome API Security Essentials" project aims to be a one-stop resource for developers, providing them with everything they need to implement comprehensive API security measures.
It provides:
- Comprehensive API security resources - articles, tutorials, and whitepapers
- Curated tools, libraries, and frameworks for implementation and testing
- Best practices, guidelines, and recommendations for secure API design
- Community-driven contributions and updates for continuous improvement
- Detailed explanations and use cases for better understanding and application
📚 Books
| Book Name | Description | Short Summary |
|---|---|---|
| API Security in Action | A comprehensive guide to API security principles and techniques by Neil Madden. | This book provides a comprehensive exploration of API security principles and practices, with a focus on securing RESTful and GraphQL APIs. It covers a wide range of topics, including handling authentication, authorization, and audit, as well as protecting data at rest and in transit. Through detailed examples and case studies, readers will gain a deep understanding of how to implement robust security measures for their APIs. |
| Hacking APIs | A practical guide on Breaking Web Application Programming Interfaces. | Hacking APIs is a crash course in web API security testing that will prepare you to penetration-test APIs, reap high rewards on bug bounty programs, and make your own APIs more secure. |
| RESTful API Design: Best Practices in API Design with REST | A book focusing on RESTful API design principles, including security considerations, by Matthias Biehl. | Focusing on the principles of designing scalable, maintainable, and high-performing RESTful APIs, this book provides guidance on versioning, pagination, and error handling. It also presents industry-proven patterns and anti-patterns to help readers avoid common pitfalls. With practical examples, readers will be able to apply these principles to their own API design projects. |
| OAuth 2.0: Getting Started in API Security | A practical guide to OAuth 2.0 and API security by Matthias Biehl. | An introductory guide to OAuth 2.0 and its role in API security, this book offers an overview of various OAuth 2.0 flows and use cases. It provides step-by-step guidance on implementing OAuth 2.0 and shares tips for maintaining security and performance. With this book, readers can confidently apply OAuth 2.0 to protect their APIs. |
| GraphQL in Action | A book covering GraphQL API design, development, and security best practices by Samer Buna. | This comprehensive guide to GraphQL implementation explores the GraphQL query language and schema design, along with strategies for securing GraphQL APIs. Through real-world case studies and examples, readers will gain a thorough understanding of how to use GraphQL in their projects while ensuring robust security measures are in place. |
| Practical API Architecture and Development with Azure and AWS | A book on API architecture and development, including security considerations, for both Azure and AWS by Thurupathan Vijayakumar. | This book offers a hands-on approach to API architecture and development using Azure and AWS platforms. It covers topics such as API design, development, deployment, and management, with a focus on integrating cloud-based services. Readers will learn how to leverage the capabilities of these platforms to create efficient, secure, and scalable APIs. |
| API Management: An Architect's Guide to Developing and Managing APIs for Your Organization | A book by Brajesh De that includes API security aspects and best practices. | This book offers valuable insights into developing and managing APIs for organizations, with a focus on the architectural aspects of API management. It covers topics such as API design, development, security, and governance, providing practical guidance on creating efficient and secure APIs that align with organizational goals. |
| Advanced API Security: OAuth 2.0 and Beyon | A book by Prabath Siriwardena that focuses on OAuth 2.0 and OpenID Connect protocols for API security. | This book provides an in-depth exploration of API security, with a focus on OAuth 2.0 and OpenID Connect protocols. It offers a detailed understanding of these protocols and their implementation, helping readers master the intricacies of API security. By the end of this book, readers will be well-versed in using OAuth |
👻 Breaches
| # | Incident | Year | Impacted Users | Primary Reason | Vulnerability | Remediation | Avoidance | Source |
|---|---|---|---|---|---|---|---|---|
| 1 | Parler API hack | 2021 | Millions | Lack of authentication for the API | Unauthenticated access to sensitive data | Reimburse affected users and implement proper authentication mechanisms for the API | Use tokens or passwords to secure the API | The Parler Hack Is a Reminder: The End-to-End Encryption Debate Isn’t Going Away |
| 2 | Peloton breach | 2021 | Millions | Misconfigured API that did not enforce proper access control policies for user data | Unauthorized access to user data without authentication | Notify affected users and implement authentication and authorization mechanisms for the API | Use tokens or roles to secure the API | Peloton’s leaky API let anyone grab riders’ private account data |
| 3 | Experian breach | 2020 (reported in 2021) | Millions | Lack of validation for the API requests that enabled unauthorized access to credit scores | Unauthorized access to credit scores by entering a name and an address | Notify affected users and implement validation mechanisms for the API requests | Verify identity or require additional information to access the API | Experian’s Credit Freeze Security is Still a Joke |
| 4 | John Deere breach | 2021 (reported in 2022) | Thousands | Lack of authorization for the API requests that enabled unauthorized access to customer data | Unauthorized access to customer data by entering a serial number of a John Deere product | Notify affected customers and implement authorization mechanisms for the API requests | Verify ownership or require authentication tokens to access the API | John Deere security flaw lets anyone download sensitive files from its site |
| 5 | Microsoft breach | 2022 | Millions | Flaw in the authentication system that enabled unauthorized access to the API. Accessing Microsoft’s API and downloading data from various products using stolen credentials obtained from phishing emails. | Unautheticated access | Implement a more robust authentication system, such as using multi-factor authentication or passwordless authentication. Encrypt data in transit and at rest. | Validate all requests and responses. Limit the number and frequency of requests. Log all API activity and audit regularly. Educate users about phishing and how to protect their accounts. | Microsoft says it thwarted recent cyberattack from group it calls ‘Lapsus$’ |
| 6 | Clubhouse | 2021 | Unknown | Public API access | Exposed user data | Implemented rate limits and added additional security measures | Regularly review and restrict API access | Cybernews |
| 7 | 2020 | 130 accounts | Social engineering attack | Insufficient internal control | Improved internal security measures and employee training | Implement strong access control and employee training | Twitter Blog | |
| 8 | Robinhood | 2020 | 2,000 | Unauthorized access | Compromised API tokens | Investigated the issue and implemented additional security measures | Properly secure sensitive data, including API tokens | Bloomberg |
| 9 | Garmin | 2020 | Unknown | Ransomware attack | Compromised API access | Garmin reportedly paid the ransom to restore their services and regain access to their data. | Regularly update and patch software, monitor API access, and implement strong authentication and encryption mechanisms. | ZDNet |
| 10 | MGM Resorts | 2020 | 10.6 million | Unauthorized access | Exposed API keys | MGM Resorts notified affected users, offered credit monitoring services, and improved network security. | Implement network segmentation, regular security audits, and use strong API access controls. | ZDNet |
| 11 | SolarWinds | 2020 | Unknown | Supply chain attack | Compromised API access | SolarWinds released a series of patches and updates to secure their software and network. | Regularly audit and monitor third-party software, implement strong authentication, and use the principle of least privilege. | SolarWinds |
| 12 | EasyJet | 2020 | 9 million | Unauthorized access | Exposed API keys | EasyJet notified affected customers, advised them to change their passwords, and increased security measures. | Monitor API usage, implement multi-factor authentication, and conduct regular security audits. | BBC |
| 13 | Marriott | 2020 | 5.2 million | Unauthorized access | Compromised API access | Marriott disabled the affected API and notified affected customers, offering identity protection services. | Regularly monitor and audit API access, implement strong authentication mechanisms, and encrypt sensitive data. |
Marriott |
| 14 | Nintendo | 2020 | 300,000 | Unauthorized access | Exposed API keys | Nintendo reset passwords for affected accounts and advised users to enable two-factor authentication. | Implement strong authentication measures, monitor API usage, and educate users about password security. | Nintendo |
| 15 | Zoom | 2020 | 500,000 | Unauthorized access | Exposed API keys | Zoom disabled the affected API and increased security measures. | Regularly audit API access, encrypt sensitive data, and implement strong authentication mechanisms. | Bleeping Computer |
| 16 | First American Corp | 2019 | 885 million | Misconfiguration of API | IDOR | Fixed the misconfiguration and conducted a thorough investigation | Regular security audits and testing for misconfigurations | KrebsOnSecurity |
| 17 | JustDial | 2019 | 100 million | Unsecured API | Lack of authentication | Secured the API and conducted an internal review | Implement proper access controls and authentication measures | The Economic Times |
| 18 | Capital One | 2019 | 106 million | Unauthorized access | Misconfigured firewall | Fixed the misconfiguration and conducted a thorough investigation | Regular security audits and testing for misconfigurations | Capital One |
| 19 | DoorDash | 2019 | 4.9 million | Unauthorized access | Exposed API keys | DoorDash added protective security layers and improved security protocols. | Regularly audit API access, implement strong authentication mechanisms, and encrypt sensitive data. | DoorDash Blog |
| 20 | Canva | 2019 | 137 million | Unauthorized access | Exposed API keys | Canva notified affected users and reset their passwords, enhancing security measures. | Implement multi-factor authentication, monitor API access for unusual activity, and encrypt sensitive data. | ZDNet |
| 21 | Zynga | 2019 | 218 million | Unauthorized access | Exposed API keys | Zynga notified affected users, reset their passwords, and enhanced security measures. |
Regularly audit API access, implement strong authentication mechanisms, and encrypt sensitive data. | The Hacker News |
| 22 | 2018 | 87 million | Misuse of API | Inadequate API access control | Facebook tightened API access and implemented regular audits | Regularly review and restrict API access for third-party apps | Facebook Newsroom | |
| 23 | 2018 | 14 million | API vulnerability | Exposed user data | Patched the vulnerability and notified affected users | Regular security testing and monitoring of API endpoints | The Information | |
| 24 | T-Mobile | 2018 | 2 million | API vulnerability | Insecure API endpoint | Patched the vulnerability and notified affected customers | Regular security testing and monitoring of API endpoints | T-Mobile |
| 25 | Panera Bread | 2018 | 37 million | Unsecured API | Exposed customer data | Secured the API and conducted an internal review | Implement proper access controls and authentication measures | KrebsOnSecurity |
| 26 | Venmo | 2018 | 207 million | Public API access | Exposed transaction data | Limited API access and updated privacy settings | Regularly review and restrict API access | Wired |
| 27 | Exactis | 2018 | 340 million | Unsecured API | Exposed personal data | Secured the API and conducted an internal review | Implement proper access controls and authentication measures | Wired |
| 28 | Google+ | 2018 | 500,000 | API vulnerability | Exposed user data | Patched the vulnerability and shut down Google+ | Regular security testing and monitoring of API endpoints | Google Blog |
| 29 | HealthEngine | 2018 | 59,600 | API vulnerability | Exposed patient data | Patched the vulnerability and notified affected users | Regular security testing and monitoring of API endpoints | ABC News |
| 30 | USPS | 2018 | 60 million | Unsecured API | Exposed user data | Secured the API and conducted an internal review | Implement proper access controls and authentication measures | KrebsOnSecurity |
| 31 | Strava | 2018 | Unknown | Public API access | Exposed user location data | Updated privacy settings and restricted API access | Regularly review and restrict API access | The Guardian |
| 32 | British Airways | 2018 | 380,000 | Unauthorized access | Compromised API access | British Airways notified affected customers, offered credit monitoring services, and improved security measures. | Implement strong API access controls, use encryption, and conduct regular security audits and assessments. | ICO |
| 33 | Uber | 2016 | 57 million | Unauthorized access | Exposed API keys | Secured API keys and implemented stronger access controls | Properly secure sensitive data, including API keys | Uber Newsroom |
| 34 | Microsoft Code Spaces | 2014 | Unknown | Unauthorized access | Exposed API keys | Shut down Code Spaces and encouraged stronger access controls | Properly secure sensitive data, including API keys | Ars Technica |
| 35 | Snapchat | 2014 | 4.6 million | API vulnerability | Exposed user data | Patched the vulnerability and improved security measures | Regular security testing and monitoring of API endpoints | Gizmodo |
🔐 Vulnerable APIs
| # | Name | Link | Short Description | Vulnerabilities | Maintainer | Active |
|---|---|---|---|---|---|---|
| 1 | OWASP crAPI | GitHub | A vulnerable API designed for learning API security practices | SQL Injection, Broken Authentication, Sensitive Data Exposure, XML External Entity (XXE), Broken Access Control, Security Misconfiguration, CORS Misconfigurations | OWASP | Yes |
| 2 | Vampi | GitHub | VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | erev0s | Yes |
| 3 | VAPI | GitHub | A vulnerable PHP API for security testing | SQL Injection, Broken Authentication, Sensitive Data Exposure, Insecure Deserialization, Broken Access Control, Security Misconfiguration | Tushar Kulkarni | Yes |
| 4 | DVNA | GitHub | Damn Vulnerable Node.js Application with insecure APIs | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | Appsecco | Yes |
| 5 | WebGoat | GitHub | A deliberately insecure web app for security training | SQL Injection, Broken Authentication, Sensitive Data Exposure, XML External Entity (XXE), Broken Access Control, Security Misconfiguration, CORS Misconfigurations | OWASP | Yes |
| 6 | Juice Shop | GitHub | A modern, intentionally insecure web application | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | OWASP | Yes |
| 7 | Gruyere | A web application with security holes used for training | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | Yes | ||
| 8 | Railsgoat | GitHub | A vulnerable Ruby on Rails application for learning security | SQL Injection, Broken Authentication, Sensitive Data Exposure, Insecure Deserialization, Broken Access Control, Security Misconfiguration | OWASP | Yes |
| 9 | Mutillidae | GitHub | A deliberately vulnerable set of PHP scripts | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | Webpwnized | Yes |
| 10 | NodeGoat | GitHub | A Node.js/Express app with security vulnerabilities | SQL Injection, Broken Authentication, Sensitive Data Exposure, XML External Entity (XXE), Broken Access Control, Security Misconfiguration, CORS Misconfigurations | OWASP | Yes |
| 11 | Hackazon | GitHub | A modern, vulnerable e-commerce web app | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | Rapid7 | Yes |
| 12 | BadStore | SourceForge | A vulnerable e-commerce web app for security training | SQL Injection, Broken Authentication, Sensitive Data Exposure, Insecure Deserialization, Broken Access Control, Security Misconfiguration | Badstore.net | Yes |
| 13 | GoatDroid | GitHub | A vulnerable Android app with insecure APIs | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | OWASP | Yes |
| 14 | AltoroJ | IBM | A vulnerable Java web app for learning application security | SQL Injection, Broken Authentication, Sensitive Data Exposure, Insecure Deserialization, Broken Access Control, Security Misconfiguration | IBM | Yes |
| 15 | Hackademic | GitHub | A vulnerable web app to learn and practice web application security | SQL Injection, Broken Authentication, Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF), Insecure Direct Object Reference (IDOR) | Hackademic | Yes |
📝 Cheatsheets
| Cheatsheet | Description |
|---|---|
| OWASP API Security Cheat Sheet | A concise collection of API security best practices by OWASP. |
| REST Security Cheat Sheet | A cheat sheet focused on security best practices for RESTful APIs. |
| OAuth 2.0 Cheat Sheet | A summary of the OAuth 2.0 security best practices by OWASP. |
| JWT Security Cheat Sheet | A cheat sheet covering JSON Web Token (JWT) security best practices. |
| GraphQL Security Cheat Sheet | A cheat sheet outlining key security aspects and best practices for GraphQL APIs. |
| HTTP Security Headers Cheat Sheet | A summary of HTTP security headers and their usage for securing APIs. |
| Input Validation Cheat Sheet | A cheat sheet focused on input validation for APIs and web applications. |
| Cross-Origin Resource Sharing (CORS) Cheat Sheet | A guide to implementing and securing CORS for APIs and web applications. |
| Content Security Policy (CSP) Cheat Sheet | A cheat sheet for implementing and securing Content Security Policy in APIs and web applications. |
| API Authentication Cheat Sheet | A cheat sheet covering API authentication best practices. |
✅ Checklists
| Checklist | Description |
|---|---|
| API Security Checklist | A comprehensive checklist of API security best practices. |
| OWASP API Security Top 10 Checklist | A printable checklist based on the OWASP API Security Top 10. |
| API Penetration Testing Checklist | A checklist for conducting API security penetration testing. |
| RESTful API Security Checklist | A checklist of security best practices for RESTful APIs. |
| API Security Audit Checklist | A checklist for auditing API security. |
| OAuth 2.0 Security Checklist | A checklist of OAuth 2.0 security best practices. |
| JSON Web Token (JWT) Security Checklist | A JWT security checklist provided by Auth0. |
| GraphQL Security Checklist | A collection of security best practices for GraphQL APIs. |
| API Documentation Security Checklist | A checklist for ensuring the security of API documentation. |
| API Security Self-Assessment Checklist | A self-assessment checklist for evaluating your organization's API security. |
🛤 API Security Learning Path
| Month | Week | Topic | Resources |
|---|---|---|---|
| Month 1 | 1 | Understanding APIs and their importance | What is an API? |
| RESTful API Design | |||
| 2 | API Security Basics | Why is API Security Important? | |
| API Security: Challenges and Solutions | |||
| 3 | Authentication and Authorization | Introduction to OAuth 2.0 | |
| Understanding JSON Web Tokens (JWT) | |||
| 4 | API Security Best Practices | API Security Best Practices | |
| OWASP API Security Top 10 | |||
| Month 2 | 5 | Rate Limiting and Throttling | Rate Limiting in APIs |
| Throttling in APIs | |||
| 6 | Input Validation and Sanitization | Input Validation for APIs | |
| Input Sanitization for APIs | |||
| 7 | Transport Security | Transport Security in APIs | |
| Using HTTPS for API Security | |||
| 8 | API Security Testing | API Security Testing | |
| Top 10 API Security Testing Tools | |||
| Month 3 | 9 | Project 1 - Building a Secure RESTful API | Tutorial: Build a Secure RESTful API |
| 10 | Project 2 - Implementing OAuth 2.0 and JWT | Tutorial: Implement OAuth 2.0 and JWT | |
| 11 | Project 3 - API Security Audit | API Security Audit Checklist |
🎥 Playlists
| Playlist Name | Link |
|---|---|
| API Security: What & How? | Link |
| Everything API Hacking | Link |
| OWASP API Security Top 10 | Link |
| API Security deep dive | Link |
| REST API Security | Link |
| API security | Link |
| API Security 101: Talks | Link |
| API Security in Microservice world | Link |
| API Security essentials | Link |
| Understanding OAuth & API security | Link |
🏗 Specifications
| Specification | Description |
|---|---|
| OpenAPI Specification (OAS) | A standard for describing and documenting RESTful APIs. |
| JSON Web Tokens (JWT) | A compact, URL-safe means of representing claims to be transferred between parties. |
| OAuth 2.0 | A widely-adopted authorization framework for securing API access. |
| OpenID Connect | An identity layer built on top of OAuth 2.0 for authentication and single sign-on. |
| GraphQL | A query language for APIs and a runtime for executing queries against your data. |
| JSON:API | A specification for building APIs in JSON. |
| HAL (Hypertext Application Language) | A standard for describing RESTful APIs using hypermedia. |
| API Blueprint | A high-level API design language for describing and designing APIs. |
| RAML (RESTful API Modeling Language) | A language for describing and designing RESTful APIs in a human-readable format. |
| WS-Security | A set of specifications for securing SOAP-based web services. |
🎙 Podcast
| Podcast | Description |
|---|---|
| The Secure Developer | A podcast that discusses security best practices for developers, including API security topics. |
| Application Security Weekly | A weekly podcast covering application security news, including API security updates. |
| The New Stack Podcast | A podcast that covers various technology topics, occasionally featuring API security discussions. |
| The CyberWire Daily Podcast | A daily cybersecurity news podcast that occasionally discusses API security. |
| Security Now | A weekly podcast discussing a wide range of security topics, including API security. |
| Darknet Diaries | A podcast that tells true stories from the dark side of the internet, occasionally featuring episodes about API security incidents. |
| Risky Business | A podcast that covers information security news and events, sometimes discussing API security. |
| Smashing Security | A cybersecurity podcast that occasionally discusses API security topics. |
| The Privacy, Security, & OSINT Show | A podcast focusing on privacy, security, and open-source intelligence topics, occasionally featuring API security discussions. |
🗂 Wikis & Collections
| Collection | Description |
|---|---|
| OWASP API Security Project | An OWASP project that provides resources and guidelines on API security. |
| API Security Encyclopedia | A comprehensive encyclopedia of API security terms and concepts. |
| API Security on Infosec | A collection of API security articles and resources by Infosec Institute. |
| API Security on DZone | A collection of API security articles, tutorials, and news on DZone. |
| API Security on Medium | A collection of API security articles and stories on Medium, contributed by various authors. |
| API Security on Hacker Noon | A collection of API security articles on Hacker Noon, contributed by various authors. |
| API Security on Dev.to | A collection of API security articles, tutorials, and discussions on Dev.to. |
| API Security on Reddit | A subreddit dedicated to API security, featuring articles, discussions, and resources. |
🗺 Mind Maps
| Mind Map | Description |
|---|---|
| API Security Mind Map | A visual representation of various API security concepts and best practices. |
| REST API Security Mind Map | A mind map that covers key security aspects of RESTful APIs. |
| OAuth 2.0 Mind Map | A visual representation of OAuth 2.0 concepts and components, which are crucial for API security. |
| API Security Testing Mind Map | A mind map that provides an overview of API security testing concepts and techniques. |
| API Management Mind Map | A mind map covering various aspects of API management, including security considerations. |
| Web Services Security Mind Map | A mind map that delves into security aspects of web services, including APIs. |
📜 Newseltters
| Newsletter | Description |
|---|---|
| The Hacker New | A blog and newsletter that covers various API topics, including security. |
| API Evangelist | A blog and newsletter by Kin Lane that covers various API topics, including security. |
| The New Stack | A platform for news and analysis on various technology topics, including API security. Subscribe to their newsletter for regular updates. |
| Secjuice | A cybersecurity publication with a dedicated section for API security articles. Subscribe to their newsletter for updates. |
| Security Weekly | A cybersecurity podcast network and newsletter that occasionally covers API security topics. |
| StatusCode Weekly | A weekly newsletter that covers web operations and occasionally includes API security articles. |
⚙ Projects
| Project | Description |
|---|---|
| OWASP API Security Project | An open-source project that aims to provide guidance and resources for API security. |
| API Security Checklist | A GitHub repository containing a checklist of essential security measures for API developers. |
| API Security in Action | A book that contains sample projects and code for implementing API security best practices. |
| ModSecurity | An open-source web application firewall (WAF) that can help protect APIs. |
| ZAP API Scan | A ZAP add-on that automates API security scanning. |
| RESTler | Microsoft's open-source, stateful REST API fuzzer for automatically testing API security. |
| GraphQL Shield | A library for securing GraphQL APIs with fine-grained access control. |
🤝 Contributing
We welcome contributions from developers of all skill levels! Check out our Contribution Guidelines to learn how you can contribute to awesome-api-security-essentials.
📖 License
Except as otherwise noted awesome-api-security-essentials is licensed under the Apache License, Version 2.0 .
🌐 Join Our Community
Connect with other API Security enthusiasts and contributors by joining our discord community. Share your experiences, ask questions, and collaborate on this exciting project!
📣 Stay Informed
Keep up-to-date with the latest news, updates, and announcements by following us on Twitter and Linkedin.