DevSecOps Practice Hub

API Security

Protect APIs with strong authentication, per-object authorisation, schema validation and rate limiting.

IntermediateSecure CodingApplicationIdentity

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Code Static analysis, secret detection and secure coding practices.
  • Test Dynamic testing, integration security tests and security gates.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

API risk concentrates in authorisation: object-level access, function-level access and property-level exposure. Schema validation and rate limiting handle the rest of the common cases.

Why it matters

APIs expose business logic directly, and broken object-level authorisation is consistently the top API weakness.

How it works

  1. 01Authenticate with short-lived tokens and validate claims server-side.
  2. 02Authorise every object access against the caller's identity.
  3. 03Validate requests and responses against a schema.
  4. 04Apply rate limits per identity, not only per IP.

Common tools

OWASP ZAPSemgrepKongKubernetesPythonGitHub

Implementation examples

pythonObject-level authorisation
# Unsafe: trusts the client-supplied tenantinvoice = db.get_invoice(request.json["invoice_id"]) # Safe: scope the lookup to the authenticated tenantinvoice = db.get_invoice(    invoice_id=request.json["invoice_id"],    tenant_id=claims["tenant_id"],)if invoice is None:    abort(404)
Scoping the query to token claims removes the enumeration path entirely.

Best practices

  • Derive tenancy from token claims.
  • Return 404 rather than 403 for objects outside scope.
  • Rate limit per identity.

Common mistakes

  • Checking authentication but not per-object authorisation.