Common API security risks are those defined by the Open Web Application Security Project (OWASP) API Security Top 10, business logic attacks, known informally as OWASP API 10+ and coding errors that are exploited by attackers.
Common API security defined by the OWASP API Security top 10 list include a threat definition and how to address them. Examples include sensitive data exposure, authentication errors, resource and rate limiting. A top 10 list means there are many others, so it’s important to use OWASP API Top 10 as a starting point.
A common API security risk often overlooked is business logic abuse, or attacks on perfectly coded APIs. Known informally as OWASP API 10+, this category encompasses the different ways perfectly coded APIs are attacked using techniques outside of the OWASP API Security Top 10. Examples include large scale shopping bots, enumeration attacks and account takeovers – all against properly coded APIs.
The last group of common API security risks are unknown vulnerability exploits caused by API coding errors. . This group of API security risks places significant emphasis on API testing as well as continuous threat detection and mitigation to protect the improperly coded API while a fix is rolled out.