Stop 10 · Application Security (AppSec)Topics · 6/9

API Security

In short

APIs are the doors between apps, and attackers love them. Weak authentication, no rate limits or over sharing data turn a handy API into an open window into your system.

Securing APIs specifically — authentication, rate limiting, input validation, and avoiding excessive data exposure — an increasingly critical AppSec area as more systems communicate via API.

The blob bank clerk checks an ID at a service counter, serving one customer.

Think of it like this

The service counter at a bank

A bank counter serves many customers quickly, but the clerk still checks ID, handles one request at a time and never reveals another customer's balance. A secure API behaves like that clerk: verify who is asking, limit the pace, and share only what is needed.

Watch it happen

A well guarded API call

Client

API

Data

GET /orders/42 + token

1/5The client sends a request with an access token proving who it is.

The big ideas

What you need to know

Authenticate and authorise

Prove who is calling, then check they may do this exact action on this exact resource, every time.

Rate limit

Cap how many requests a client can make. It blunts brute force and keeps one caller from flooding you.

Validate input

Check and constrain every parameter. Never trust that a client sends only what your UI allows.

Avoid over exposure

Return only the fields needed. Dumping full objects leaks data and is a top API risk.

See it in code

Walk through the code

1// Express: authorise, then return only safe fields2app.get("/orders/:id", requireAuth, rateLimit, async (req, res) => {3  const order = await db.order.findFirst({4    where: { id: req.params.id, userId: req.user.id },5    select: { id: true, total: true, status: true },6  });7  if (!order) return res.status(404).json({ error: "Not found" });8  res.json(order);9});

1/3requireAuth proves identity and rateLimit caps request rate before any work happens.

The query filters by the caller's own id and selects only safe fields, so a logged in user cannot read another person's order or hidden columns.

Save yourself the pain

Common mistakes

Oops

Checking the user is logged in but not that the record is theirs.

Do this instead

Authentication is not authorisation. Verify ownership on every request, or anyone can read others' data by id.

Oops

Returning the full database object to save effort.

Do this instead

Select only the fields the client needs. Full objects leak internal and sensitive data you never meant to share.

Your mission

Secure one endpoint

~40 min

Quick check

An API checks the token is valid but returns any order by id. What is missing?

Go deeper

1Test a sample API for missing authentication or rate limiting.
2Learn the OWASP API Security Top 10 as the API-specific equivalent of the general web Top 10.
3Understand why APIs often expose more data than the UI displays, creating hidden risk.