API Security — OWASP API Top 10

OWASP API Top 10 (2023)

1. Broken Object Level Authorization (BOLA)
2. Broken Authentication
3. Broken Object Property Level Authorization
4. Unrestricted Resource Consumption
5. Broken Function Level Authorization
6. Unrestricted Sensitive Business Flows
7. SSRF
8. Security Misconfiguration
9. Improper Inventory Management
10. Unsafe Consumption of APIs

BOLA (#1) ⭐

// ❌ যে কেউ যে কারো order দেখতে পারে
GET /api/orders/123
public Order Get(int id) => _db.Orders.Find(id);

// ✅ Ownership check
public Order Get(int id) {
    var o = _db.Orders.Find(id);
    if (o.UserId != currentUserId) throw new ForbiddenException();
    return o;
}

BOPLA (#3)

// ❌ User PUT with {"name":"x","isAdmin":true}
// ✅ DTO whitelist (no IsAdmin field)

Rate Limiting

builder.Services.AddRateLimiter(opt => {
  opt.AddFixedWindowLimiter("api", o => {
    o.PermitLimit = 100;
    o.Window = TimeSpan.FromMinutes(1);
  });
});

Input Validation

public class CreateOrderDto {
    [Required, StringLength(100)]
    public string Name { get; set; }
    [EmailAddress] public string Email { get; set; }
    [Range(1, 1000)] public int Qty { get; set; }
    [RegularExpression(@"^\d{11}$")]
    public string Phone { get; set; }
}

Injection Prevention

// ❌ $"SELECT * WHERE id={input}"
// ✅ Parameterized
cmd.Parameters.AddWithValue("@id", input);

// NoSQL injection — type check
const name = String(req.body.name);

SSRF Prevention

// ❌ Fetch user URL → 169.254.169.254/metadata
// ✅ Allowlist domains, block private IPs

Secrets Management

• ❌ Hardcode, .env in git
• ✅ Env vars, AWS Secrets Manager
• ✅ Azure Key Vault, HashiCorp Vault
• ✅ Rotate regularly

Security Headers

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'

Testing Tools

OWASP ZAP, Burp Suite, Postman, Snyk, SonarQube, dependency scan।