An API security review must cover identity, object-level authorisation, input, resource consumption, data exposure, inventory, dependencies, monitoring, and response. A valid token alone does not make an API safe.
Define the API Boundary
Inventory endpoints, versions, protocols, environments, owners, consumers, data classes, and downstream systems. Remove forgotten test hosts and deprecated versions or give them the same controls as production.
Document trust boundaries. Internet, partner, employee, mobile, and service-to-service clients require explicit assumptions—not security through an obscure URL.
Authenticate Every Caller
Use established identity protocols and validated libraries. Verify issuer, audience, signature, expiry, and intended token use. Keep service identities separate and rotate credentials.
Do not place long-lived API keys in mobile or browser applications where users can extract them. Apply stronger authentication and proof where transaction risk demands it.
Authorise Every Object and Action
Check permission server-side for every request, action, and referenced record. Never assume that knowing an object ID grants access. Filter queries by the authorised tenant or owner rather than fetching first and checking inconsistently.
Protect administrative functions and sensitive fields separately. Test horizontal access between two users and vertical access between roles.
Validate Requests and Responses
Use explicit schemas, length and range limits, safe parser settings, content-type enforcement, and allowlists where appropriate. Parameterise database operations and constrain URLs used for server-side fetching.
Return only required fields. Prevent mass assignment by mapping permitted properties rather than binding arbitrary client input to internal models.
Control Resource Consumption
Set request-size, pagination, concurrency, timeout, query-complexity, and rate limits. Apply quotas by authenticated consumer and operation, not only IP address. Use idempotency keys for retryable write operations.
Bound downstream calls and queues so an apparently small request cannot trigger unbounded cost.
Protect Transport and Browser Use
Require modern TLS and validate certificates. Configure CORS for exact trusted origins rather than treating it as authentication. Use CSRF protection when browser credentials are sent automatically.
Avoid exposing sensitive values in URLs, errors, logs, and analytics.
Operate the API
Maintain a version and dependency inventory. Scan code and packages, protect secrets, and sign or attest delivery artifacts where practical. Log authentication outcomes, authorisation denials, sensitive actions, configuration changes, and abnormal consumption without recording secrets.
Test abuse cases in CI and before material release. Define ownership, escalation, revocation, customer communication, and evidence preservation.
DualByte's cybersecurity service can perform an API threat assessment and implement controls across application and cloud layers.
Sources
Need help with implementation?
Get a free consultation with the DualByte team for your business technology needs.
