The 10 most critical API security risks - Part 7: Security Misconfiguration 
Tags: apisecurity, api, owasp, security
Published: 2020-03-03 17:04:41

---
title: The 10 most critical API security risks - Part 7: Security Misconfiguration 
published: true
description: The recently published OWASP API security top 10 report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns. In
tags: API Security, API, OWASP, Security
canonical_url: https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks-part-7-security-misconfiguration/
series: API-University - OWASP API security risks
---

The recently published *“OWASP API security top 10”* report analyzes the anti-patterns that lead to vulnerabilities and security risks in APIs. In this 10 part series, we introduce these API anti-patterns. Every API professional should know about these anti-patterns. In this blog post, we focus on “API security misconfiguration”.

![](https://api-university.com/wp-content/uploads/2020/01/owasp-api-07-1-1024x393.png)**API security anti-pattern for Security Misconfiguration**

Security misconfiguration is commonly a result of insecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information.

The good thing is, that it is relatively easy to fix security misconfiguration and considerably improve the API security as a result.

**Want to learn more?**

- [Part 1 Broken Object Level Authorization ](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-1:-broken-object-level-authorization)
- [Part 2 Broken User Authentication](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-2:-broken-user-authentication)
- [Part 3 Excessive Data Exposure](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-3:-excessive-data-exposure)
- [Part 4 Lack of Resources & Rate Limiting](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-4:-lack-of-resources-&-rate-limiting/)
- [Part 5 Broken Function Level Authorization](https://api-university.com/blog/the-10-most-critical-api-security-risks---part-5:-broken-function-level-authorization)
- [Part 6 Mass Assignment](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-6:-mass-assignment)
- [Part 7 Security Misconfiguration](https://api-university.com/blog/api-security/the-10-most-critical-api-security-risks---part-7:-security-misconfiguration)

Check out the complete [OWASP API security paper](https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf). To secure access to your APIs, learn more about the OAuth in the [OAuth Book](https://api-university.com/books/oauth-2-0-book/), or the [OAuth Course](https://api-university.com/courses/oauth-2-0-course/). To provide and use identity data in apps and APIs, learn more about OpenID Connect in the [OpenID Connect Book](https://api-university.com/books/openid-connect/), or the [OpenID Connect Course](https://api-university.com/courses/openid-connect/).