Skip to main content
northwind-bank / api-console Live
GET /api/accounts/ You are logged in as account 1024. Change the number, then Send.
200 OK application/json Records exposed: 0
That should not have worked.

No password. No special access. Just a different number in the URL, and the API handed you someone else's account. This is API1: Broken Object Level Authorization. Now scroll down.

The ten risks

You just ran number one. Here are all ten.

The guide breaks down each one the same way: what it is, the request that exploits it, and the control that closes it.

API1 Broken Object Level Authorization

Users reaching records that belong to someone else by changing an ID. The T-Mobile pattern.

API2 Broken Authentication

Weak tokens, missing MFA, and sessions that let attackers impersonate users.

API3 Broken Object Property Level Authorization

Exposing or letting users edit fields they were never meant to touch.

API4 Unrestricted Resource Consumption

No limits on requests, uploads, or queries, leading to outages and cloud bills.

API5 Broken Function Level Authorization

Standard users reaching admin-only endpoints and actions.

API6 Unrestricted Access to Sensitive Business Flows

Bots abusing legitimate workflows at scale: scalping, fraud, hoarding.

API7 Server-Side Request Forgery

Tricking your server into calling internal systems and cloud metadata.

API8 Security Misconfiguration

Default credentials, debug modes, and permissive settings shipped to production.

API9 Improper Inventory Management

Shadow and deprecated APIs that nobody is tracking or patching.

API10 Unsafe Consumption of APIs

Trusting third-party APIs without validating what comes back.

Why this guide

Written to be used, not filed away.

Built on the current standard

Maps directly to the OWASP API Security Top 10, 2023 edition.

Vendor-neutral

Nothing to buy. Works with the stack you already run.

Practitioner-first

Real endpoints and fixes, not abstract theory.

For the whole team

The engineers who ship the endpoints and the leads who answer for them.

37 million reasons to read it.

Ten exploits. Ten fixes. One free PDF.

Get the free guide