deardaniel/secdata-raw huggingface dataset:
OWASP API Security Top 10: 0xb1 next devsecops

# What's Next For DevSecOps

Due to their importance in modern application architectures, building secure
APIs is crucial. Security cannot be neglected, and it should be part of the
whole development life cycle. Scanning and penetration testing yearly are no
longer enough.

DevSecOps should join the development effort, facilitating continuous security
testing across the entire software development life cycle. Your goal should be
to enhance the development pipeline with security automation, but without
impacting the speed of development.

In case of doubt, stay informed, and refer to the [DevSecOps Manifesto][1].

| | |
|-|-|
| **Understand the Threat Model** | Testing priorities come from a threat model. If you don't have one, consider using [OWASP Application Security Verification Standard (ASVS)][2], and the [OWASP Testing Guide][3] as an input. Involving the development team will help to make them more security-aware. |
| **Understand the SDLC** | Join the development team to better understand the Software Development Life Cycle. Your contribution on continuous security testing should be compatible with people, processes, and tools. Everyone should agree with the process, so that there's no unnecessary friction or resistance. |
| **Testing Strategies** | Since your work should not impact the development speed, you should wisely choose the best (simple, fastest, most accurate) technique to verify the security requirements. The [OWASP Security Knowledge Framework][4] and [OWASP Application Security Verification Standard][2] can be great sources of functional and nonfunctional security requirements. There are other great sources for [projects][5] and [tools][6] similar to the one offered by the [DevSecOps community][7]. |
| **Achieving Coverage and Accuracy** | You're the bridge between developers and operations teams. To achieve coverage, not only should you focus on the functionality, but also the orchestration. Work close to both development and operations teams from the beginning so you can optimize your time and effort. You should aim for a state where the essential security is verified continuously. |
| **Clearly Communicate Findings** | Contribute value with less or no friction. Deliver findings in a timely fashion, within the tools development teams are using (not PDF files). Join the development team to address the findings. Take the opportunity to educate them, clearly describing the weakness and how it can be abused, including an attack scenario to make it real. |

[1]: https://www.devsecops.org/
[2]: https://owasp.org/www-project-application-security-verification-standard/
[3]: https://owasp.org/www-project-web-security-testing-guide/
[4]: https://owasp.org/www-project-security-knowledge-framework/
[5]: http://devsecops.github.io/
[6]: https://github.com/devsecops/awesome-devsecops
[7]: http://devsecops.org
OWASP API Security Top 10: 0x00 header

---
title: ''
description: OWASP API Security Top 10 2023 edition
---

![OWASP LOGO](images/cover.jpg)

| | | |
| - | - | - |
| https://owasp.org | This work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 International License][1] | ![Creative Commons License Logo](images/front-cc.png) |

[1]: http://creativecommons.org/licenses/by-sa/4.0/
OWASP API Security Top 10: 0x02 foreword

# Foreword

A foundational element of innovation in today's app-driven world is the
Application Programming Interface (API). From banks, retail, and transportation
to IoT, autonomous vehicles, and smart cities, APIs are a critical part of
modern mobile, SaaS, and web applications and can be found in customer-facing,
partner-facing, and internal applications.

By nature, APIs expose application logic and sensitive data such as Personally
Identifiable Information (PII) and because of this, APIs have increasingly
become a target for attackers. Without secure APIs, rapid innovation would be
impossible.

Although a broader web application security risks Top 10 still makes sense, due
to their particular nature, an API-specific security risks list is required.
API security focuses on strategies and solutions to understand and mitigate the
unique vulnerabilities and security risks associated with APIs.

If you're familiar with the [OWASP Top 10 Project][1], then you'll notice the
similarities between both documents: they are intended for readability and
adoption. If you're new to the OWASP Top 10 series, you may be better off
reading the [API Security Risks][2] and [Methodology and Data][3] sections
before jumping into the Top 10 list.

You can contribute to OWASP API Security Top 10 with your questions, comments,
and ideas at our GitHub project repository:

* https://owasp.org/www-project-api-security/
* https://github.com/OWASP/API-Security/blob/master/CONTRIBUTING.md

You can find the OWASP API Security Top 10 here:

* https://owasp.org/www-project-api-security/
* https://github.com/OWASP/API-Security

We wish to thank all the contributors who made this project possible with their
effort and contributions. They are all listed in the [Acknowledgments
section][4]. Thank you!

[1]: https://owasp.org/www-project-top-ten/
[2]: ./0x10-api-security-risks.md
[3]: ./0xd0-about-data.md
[4]: ./0xd1-acknowledgments.md
OWASP API Security Top 10: 0x03 introduction

# Introduction

## Welcome to the OWASP API Security Top 10 - 2023!

Welcome to the second edition of the OWASP API Security Top 10!

This awareness document was first published back in 2019. Since then, the API
Security industry has flourished and become more mature. We strongly believe
this work has positively contributed to it, due to it being quickly adopted as
an industry reference.

APIs play a very important role in modern application architecture. But since
innovation has a different pace than creating security awareness, we believe
it's important to focus on creating awareness for common API security
weaknesses.

The primary goal of the OWASP API Security Top 10 is to educate those involved
in API development and maintenance, for example, developers, designers,
architects, managers, or organizations. You can know more about the API Security
Project visiting [the project page][1].

If you're not familiar with the OWASP top 10 series, we recommend checking at
least the following top 10 projects:

* [OWASP Cloud-Native Application Security Top 10][2]
* [OWASP Desktop App Security Top 10][3]
* [OWASP Docker Top 10][4]
* [OWASP Low-Code/No-Code Top 10][5]
* [OWASP Machine Learning Security Top Ten][6]
* [OWASP Mobile Top 10][7]
* [OWASP TOP 10][8]
* [OWASP Top 10 CI/CD Security Risks][9]
* [OWASP Top 10 Client-Side Security Risks][10]
* [OWASP Top 10 Privacy Risks][11]
* [OWASP Serverless Top 10][12]

None of the projects replaces another: if you're working on a mobile application
powered by a back-end API, you're better off reading both the corresponding top
10's. The same is valid if you're working on a web or desktop application
powered by APIs.

In the [Methodology and Data][13] section, you can read more about how this
edition was created. For now, we encourage everyone to contribute with
questions, comments, and ideas at our [GitHub repository][14] or
[Mailing list][15].

[1]: https://owasp.org/www-project-api-security/
[2]: https://owasp.org/www-project-cloud-native-application-security-top-10/
[3]: https://owasp.org/www-project-desktop-app-security-top-10/
[4]: https://owasp.org/www-project-docker-top-10/
[5]: https://owasp.org/www-project-top-10-low-code-no-code-security-risks/
[6]: https://owasp.org/www-project-machine-learning-security-top-10/
[7]: https://owasp.org/www-project-mobile-top-10/
[8]: https://owasp.org/www-project-top-ten/
[9]: https://owasp.org/www-project-top-10-ci-cd-security-risks/
[10]: https://owasp.org/www-project-top-10-client-side-security-risks/
[11]: https://owasp.org/www-project-top-10-privacy-risks/
[12]: https://owasp.org/www-project-serverless-top-10/
[13]: ./0xd0-about-data.md
[14]: https://github.com/OWASP/API-Security
[15]: https://groups.google.com/a/owasp.org/forum/#!forum/api-security-project
OWASP API Security Top 10: 0xd1 acknowledgments

# Acknowledgments

## Acknowledgments to Contributors

We'd like to thank the following contributors who contributed publicly on
GitHub, or via other means:

247arjun, abunuwas, Alissa Knight, Arik Atar, aymenfurter, Corey J. Ball, cyn8,
d0znpp, Dan Gordon, donge, Dor Tumarkin, faizzaidi, gavjl, guybensimhon, Inês
Martins, Isabelle Mauny, Ivan Novikov, jmanico, Juan Pablo, k7jto, LaurentCB,
llegaz, Maxim Zavodchik, MrPRogers, planetlevel, rahulk22, Roey Eliyahu, Roshan
Piyush, securitylevelup, sudeshgadewar123, Tatsuya-hasegawa, tebbers, vanderaj,
wenz, xplo1t-sec, Yaniv Balmas, ynvb
OWASP API Security Top 10: 0x04 release notes

# Release Notes

This is the second edition of the OWASP API Security Top 10 edition, exactly
four years after its first release. A lot has changed in the API (security)
scene. API traffic increased at a fast pace, some API protocols gained a lot
more traction, many new API security vendors/solutions have popped up, and, of
course, attackers have developed new skills and techniques to compromise
APIs. It was about time to get the list of the ten most critical API security
risks updated.

With a more mature API security industry, for the first time, there was [a
public call for data][1]. Unfortunately, no data was contributed, but based on
the project's team experience, careful API security specialist review, and
community feedback on the release candidate, we built this new list. In the
[Methodology and Data section][2], you'll find more details about how this
version was built. For more details about the security risks please refer to the
[API Security Risks section][3].

The OWASP API Security Top 10 2023 is a forward-looking awareness document for
a fast pace industry. It does not replace other TOP 10's. In this edition:

* We've combined Excessive Data Exposure and Mass Assignment focusing on the
  common root cause: object property level authorization validation failures.
* We've put more emphasis on resource consumption, over focusing on the pace
  they are exhausted.
* We've created a new category "Unrestricted Access to Sensitive Business Flows"
  to address new threats, including most of those that can be mitigated using
  rate limiting.
* We added "Unsafe Consumption of APIs" to address something we've started
  seeing: attackers have started looking for a target's integrated services to
  compromise those, instead of hitting the APIs of their target directly. This
  is the right time to start creating awareness about this increasing risk.

APIs play an increasingly important role in modern microservices architecture,
Single Page Applications (SPAs), mobile apps, IoT, etc. The OWASP API Security
Top 10 is a required effort to create awareness about modern API security
issues.

This update was only possible due to the great effort of several volunteers,
listed in the [Acknowledgments][4] section.

Thank you!

[1]: https://owasp.org/www-project-api-security/announcements/cfd/2022/
[2]: ./0xd0-about-data.md
[3]: ./0x10-api-security-risks.md
[4]: ./0xd1-acknowledgments.md
OWASP API Security Top 10: 0x10 api security risks

# API Security Risks

The [OWASP Risk Rating Methodology][1] was used to do the risk analysis.

The table below summarizes the terminology associated with the risk score.

| Threat Agents | Exploitability | Weakness Prevalence | Weakness Detectability | Technical Impact | Business Impacts |
| :-: | :-: | :-: | :-: | :-: | :-: |
| API Specific | Easy: **3** | Widespread **3** | Easy **3** | Severe **3** | Business Specific |
| API Specific | Average: **2** | Common **2** | Average **2** | Moderate **2** | Business Specific |
| API Specific | Difficult: **1** | Difficult **1** | Difficult **1** | Minor **1** | Business Specific |

**Note**: This approach does not take the likelihood of the threat agent into
account. Nor does it account for any of the various technical details associated
with your particular application. Any of these factors could significantly
affect the overall likelihood of an attacker finding and exploiting a particular
vulnerability. This rating does not take into account the actual impact on your
business. Your organization will have to decide how much security risk from
applications and APIs the organization is willing to accept given your culture,
industry, and regulatory environment. The purpose of the OWASP API Security Top
10 is not to do this risk analysis for you. Since this edition is not
data-driven, prevalence results from a consensus among the team members.

## References

### OWASP

* [OWASP Risk Rating Methodology][1]
* [Article on Threat/Risk Modeling][2]

### External

* [ISO 31000: Risk Management Std][3]
* [ISO 27001: ISMS][4]
* [NIST Cyber Framework (US)][5]
* [ASD Strategic Mitigations (AU)][6]
* [NIST CVSS 3.0][7]
* [Microsoft Threat Modeling Tool][8]

[1]: https://owasp.org/www-project-risk-assessment-framework/
[2]: https://owasp.org/www-community/Threat_Modeling
[3]: https://www.iso.org/iso-31000-risk-management.html
[4]: https://www.iso.org/isoiec-27001-information-security.html
[5]: https://www.nist.gov/cyberframework
[6]: https://www.asd.gov.au/infosec/mitigationstrategies.htm
[7]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
[8]: https://www.microsoft.com/en-us/download/details.aspx?id=49168
OWASP API Security Top 10: 0x00 toc

# Table of Contents

* [Table of Contents](0x00-toc.md)
* [About OWASP](0x01-about-owasp.md)
* [Foreword](0x02-foreword.md)
* [Introduction](0x03-introduction.md)
* [Release Notes](0x04-release-notes.md)
* [API Security Risks](0x10-api-security-risks.md)
* [OWASP Top 10 API Security Risks – 2023](0x11-t10.md)
* [API1:2023 Broken Object Level Authorization](0xa1-broken-object-level-authorization.md)
* [API2:2023 Broken Authentication](0xa2-broken-authentication.md)
* [API3:2023 Broken Object Property Level Authorization](0xa3-broken-object-property-level-authorization.md)
* [API4:2023 Unrestricted Resource Consumption](0xa4-unrestricted-resource-consumption.md)
* [API5:2023 Broken Function Level Authorization](0xa5-broken-function-level-authorization.md)
* [API6:2023 Unrestricted Access to Sensitive Business Flows](0xa6-unrestricted-access-to-sensitive-business-flows.md)
* [API7:2023 Server Side Request Forgery](0xa7-server-side-request-forgery.md)
* [API8:2023 Security Misconfiguration](0xa8-security-misconfiguration.md)
* [API9:2023 Improper Inventory Management](0xa9-improper-inventory-management.md)
* [API10:2023 Unsafe Consumption of APIs](0xaa-unsafe-consumption-of-apis.md)
* [What's Next For Developers](0xb0-next-devs.md)
* [What's Next For DevSecOps](0xb1-next-devsecops.md)
* [Methodology and Data](0xd0-about-data.md)
* [Acknowledgments](0xd1-acknowledgments.md)
OWASP API Security Top 10: 0x01 about owasp

# About OWASP

The Open Worldwide Application Security Project (OWASP) is an open community
dedicated to enabling organizations to develop, purchase, and maintain
applications and APIs that can be trusted.

At OWASP, you'll find free and open:

* Application security tools and standards.
* Complete books on application security testing, secure code development, and
  secure code review.
* Presentations and [videos][1].
* [Cheat sheets][2] on many common topics.
* Standard security controls and libraries.
* [Local chapters worldwide][3].
* Cutting edge research.
* Extensive [conferences worldwide][4].
* [Mailing lists][5] ([archive][6]).

Learn more at: [https://www.owasp.org][7].

All OWASP tools, documents, videos, presentations, and chapters are free and
open to anyone interested in improving application security.

We advocate approaching application security as a people, process, and
technology problem, because the most effective approaches to application
security require improvements in these areas.

OWASP is a new kind of organization. Our freedom from commercial pressures
allows us to provide unbiased, practical, and cost-effective information about
application security.

OWASP is not affiliated with any technology company, although we support the
informed use of commercial security technology. OWASP produces many types of
materials in a collaborative, transparent, and open way.

The OWASP Foundation is the non-profit entity that ensures the project's
long-term success. Almost everyone associated with OWASP is a volunteer,
including the OWASP board, chapter leaders, project leaders, and project
members. We support innovative security research with grants and infrastructure.

Come join us!

## Copyright and License

![license](images/license.png)

Copyright © 2003-2023 The OWASP Foundation. This document is released under the
[Creative Commons Attribution Share-Alike 4.0 license][8]. For any reuse or
distribution, you must make it clear to others the license terms of this work.

[1]: https://www.youtube.com/user/OWASPGLOBAL
[2]: https://cheatsheetseries.owasp.org/
[3]: https://owasp.org/chapters/
[4]: https://owasp.org/events/
[5]: https://groups.google.com/a/owasp.org/forum/#!overview
[6]: https://lists.owasp.org/mailman/listinfo
[7]: https://www.owasp.org
[8]: http://creativecommons.org/licenses/by-sa/4.0/
OWASP API Security Top 10: 0x00 notice

# Note

Ce document est la version texte traduite en français de l'OWASP API Security Top 10. Il est utilisé comme source pour toutes les versions officielles de ce document, telles que le site web.


Les contributions au projet telles que les commentaires, les corrections ou les traductions doivent être effectuées ici. Pour plus de détails sur [Comment contribuer][1], veuillez vous référer à [CONTRIBUTING.md][1].

* Erez Yallon
* Inon Shkedy
* Paulo Silva

[1]: ../../../CONTRIBUTING.md
OWASP API Security Top 10: 0x00 header

---
title: ''
description: OWASP API Security Top 10 2023 edition
---

![OWASP LOGO](images/cover.jpg)

| | | |
| - | - | - |
| https://owasp.org | Ce travail est sous licence [Creative Commons Attribution-ShareAlike 4.0 International License][1] | ![Creative Commons License Logo](images/front-cc.png) |

[1]: http://creativecommons.org/licenses/by-sa/4.0/
OWASP API Security Top 10: 0x02 foreword

# Avant-propos

Actuellement, l'innovation dans le monde des applications est portée par l'Interface de Programmation Applicative (API). 
Des banques en passant par le commerce et le transport, jusqu'à l'IoT, les véhicules autonomes et les villes intelligentes, les API sont une partie essentielle des applications modernes, que ces applications soient des logiciels, des applications web ou mobiles. Les API peuvent être utilisées dans des applications destinées aux consommateurs, aux partenaires ou à des usages internes.

Par nature, les API exposent la logique de l'application et des données sensibles telles que les données à caractère personnel (DCP) et, en raison de cela, les API sont devenues de plus en plus une cible privilégiée pour les attaquants. Sans API sécurisées, une innovation rapide serait impossible.

Bien que la liste des 10 principaux risques de sécurité des applications web soit toujours pertinente, en raison la nature particulière des API, une liste spécifique des risques de sécurité consacrée aux API était nécessaire. La sécurité des API se concentre sur des stratégies et des solutions pour comprendre et atténuer les vulnérabilités uniques et les risques de sécurité associés aux API.

Si vous êtes familier avec le [Projet OWASP Top 10][1], vous remarquerez les similitudes entre les deux documents : ils sont conçus pour être lisibles et pour facilement se les approprier. Si vous êtes nouveau dans la série OWASP Top 10, vous feriez peut-être mieux de lire les sections [Risques de sécurité des API][2] et [Méthodologie et données][3] avant de vous plonger dans la liste du Top 10.

Vous pouvez contribuer au OWASP API Security Top 10 avec vos questions, commentaires et idées sur notre dépôt de projet GitHub :

* https://owasp.org/www-project-api-security/
* https://github.com/OWASP/API-Security/blob/master/CONTRIBUTING.md

Vous pouvez trouver le OWASP API Security Top 10 ici :

* https://owasp.org/www-project-api-security/
* https://github.com/OWASP/API-Security

Nous tenons à remercier tous les contributeurs qui ont rendu ce projet possible par leur effort et leurs contributions. Ils sont tous répertoriés dans la [section Remerciements][4]. Merci !

[1]: https://owasp.org/www-project-top-ten/
[2]: ./0x10-api-security-risks.md
[3]: ./0xd0-about-data.md
[4]: ./0xd1-acknowledgments.md
OWASP API Security Top 10: 0x03 introduction

# Introduction

## Bienvenue dans le OWASP API Security Top 10 - 2023!

Bienvenue dans la seconde édition du OWASP API Security Top 10!

Ce document de sensibilisation a été publié pour la première fois en 2019. Depuis
lors, le secteur de la sécurité des API a prospéré et est devenue plus mature.
Nous croyons fermement que la première édition de ce document a contribué positivement à cette industrie,
car il a rapidement été adopté comme une référence.

Les API jouent un rôle très important dans l'architecture moderne des applications.
Mais comme l'innovation évolue à un rythme différent de la sensibilisation à la sécurité,
nous pensons qu'il est important de se concentrer sur la sensibilisation à la sécurité des API.

Le principal objectif du OWASP API Security Top 10 est d'éduquer ceux qui sont
impliqués dans le développement et la maintenance des API, par exemple, les
développeurs, les designers, les architectes, les managers ou les
organisations. Vous pouvez en savoir plus sur le projet en
visitant [la page du projet][1].

Si vous n'êtes pas familier avec la série OWASP top 10, nous vous recommandons de
consulter au moins les projets suivants :

* [OWASP Cloud-Native Application Security Top 10][2]
* [OWASP Desktop App Security Top 10][3]
* [OWASP Docker Top 10][4]
* [OWASP Low-Code/No-Code Top 10][5]
* [OWASP Machine Learning Security Top Ten][6]
* [OWASP Mobile Top 10][7]
* [OWASP TOP 10][8]
* [OWASP Top 10 CI/CD Security Risks][9]
* [OWASP Top 10 Client-Side Security Risks][10]
* [OWASP Top 10 Privacy Risks][11]
* [OWASP Serverless Top 10][12]

Aucun de ces projets n'en remplace un autre : si vous travaillez sur une application
mobile alimentée par une API back-end, vous feriez mieux de lire les deux Top 10
correspondants. Il en va de même si vous travaillez sur une application web ou
de bureau alimentée par des API.

Dans la section [Méthodologie et données][13], vous pouvez en savoir plus sur la
façon dont cette édition a été créée. Nous encourageons tout le
monde à contribuer avec des questions, des commentaires et des idées sur notre
[dépôt GitHub][14] ou notre [liste de diffusion][15].

[1]: https://owasp.org/www-project-api-security/
[2]: https://owasp.org/www-project-cloud-native-application-security-top-10/
[3]: https://owasp.org/www-project-desktop-app-security-top-10/
[4]: https://owasp.org/www-project-docker-top-10/
[5]: https://owasp.org/www-project-top-10-low-code-no-code-security-risks/
[6]: https://owasp.org/www-project-machine-learning-security-top-10/
[7]: https://owasp.org/www-project-mobile-top-10/
[8]: https://owasp.org/www-project-top-ten/
[9]: https://owasp.org/www-project-top-10-ci-cd-security-risks/
[10]: https://owasp.org/www-project-top-10-client-side-security-risks/
[11]: https://owasp.org/www-project-top-10-privacy-risks/
[12]: https://owasp.org/www-project-serverless-top-10/
[13]: ./0xd0-about-data.md
[14]: https://github.com/OWASP/API-Security
[15]: https://groups.google.com/a/owasp.org/forum/#!forum/api-security-project
OWASP API Security Top 10: 0xd1 acknowledgments

# Remerciements

## Remerciements aux Contributeurs

Nous aimerions remercier les contributeurs suivants qui ont contribué publiquement sur GitHub, ou via d'autres moyens :

247arjun, abunuwas, Alissa Knight, Arik Atar, Aurélien Troncy, aymenfurter, Corey J. Ball, cyn8,
d0znpp, Dan Gordon, donge, Dor Tumarkin, faizzaidi, gavjl, guybensimhon, Inês
Martins, Isabelle Mauny, Ivan Novikov, jmanico, Juan Pablo, k7jto, LaurentCB,
llegaz, Maxim Zavodchik, MrPRogers, planetlevel, rahulk22, Roey Eliyahu, Roshan
Piyush, securitylevelup, sudeshgadewar123, Tatsuya-hasegawa, tebbers, vanderaj,
wenz, xplo1t-sec, Yaniv Balmas, ynvb