├── _data └── ow_attributions.json ├── .gitignore ├── Gemfile ├── assets ├── images │ ├── roadmap.png │ ├── sponsors │ │ ├── salt.png │ │ ├── impart.png │ │ ├── checkmarx.png │ │ ├── equixly.png │ │ ├── traceable.png │ │ └── cequence-security.png │ ├── owasp-20th-anniversary.png │ └── by-sa.svg └── presentations │ ├── api-security-top10.pdf │ ├── owasp-api-security-project-kick-off.pdf │ └── api-security-top10-rc-global-appsec-ams.pdf ├── leaders.md ├── _config.yml ├── tab_roadmap.md ├── announcements ├── 2023 │ └── 02 │ │ └── api-top10-2023rc.md └── cfd │ └── 2022 │ ├── sample-data-submission.csv │ ├── sample-data-submission.json │ ├── info.md │ └── index.md ├── .github └── workflows │ └── validate-owasp-metadata.yaml ├── 404.html ├── tab_join.md ├── project.owasp.yaml ├── info.md ├── tab_acknowledgments.md ├── tab_news.md ├── tab_translations.md └── index.md /_data/ow_attributions.json: -------------------------------------------------------------------------------- 1 | ["John Jeremiah", "Jason Kent", "Traceable"] -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | __pycache__ 2 | env 3 | .vscode 4 | _site/ 5 | Gemfile.lock 6 | -------------------------------------------------------------------------------- /Gemfile: -------------------------------------------------------------------------------- 1 | source 'https://rubygems.org' 2 | group :jekyll_plugins do 3 | gem "github-pages" 4 | end -------------------------------------------------------------------------------- /assets/images/roadmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/roadmap.png -------------------------------------------------------------------------------- /assets/images/sponsors/salt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/sponsors/salt.png -------------------------------------------------------------------------------- /assets/images/sponsors/impart.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/sponsors/impart.png -------------------------------------------------------------------------------- /assets/images/sponsors/checkmarx.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/sponsors/checkmarx.png -------------------------------------------------------------------------------- /assets/images/sponsors/equixly.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/sponsors/equixly.png -------------------------------------------------------------------------------- /assets/images/sponsors/traceable.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/sponsors/traceable.png -------------------------------------------------------------------------------- /assets/images/owasp-20th-anniversary.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/owasp-20th-anniversary.png -------------------------------------------------------------------------------- /assets/presentations/api-security-top10.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/presentations/api-security-top10.pdf -------------------------------------------------------------------------------- /assets/images/sponsors/cequence-security.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/images/sponsors/cequence-security.png -------------------------------------------------------------------------------- /assets/presentations/owasp-api-security-project-kick-off.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/presentations/owasp-api-security-project-kick-off.pdf -------------------------------------------------------------------------------- /leaders.md: -------------------------------------------------------------------------------- 1 | ### Leaders 2 | 3 | * [Erez Yalon](mailto:erez.yalon@owasp.org) 4 | * [Inon Shkedy](mailto:inon.shkedy@owasp.org) 5 | * [Paulo Silva](mailto:paulo.silva@owasp.org) 6 | 7 | -------------------------------------------------------------------------------- /assets/presentations/api-security-top10-rc-global-appsec-ams.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/OWASP/www-project-api-security/HEAD/assets/presentations/api-security-top10-rc-global-appsec-ams.pdf -------------------------------------------------------------------------------- /_config.yml: -------------------------------------------------------------------------------- 1 | remote_theme: "owasp/www--site-theme@main" 2 | 3 | #override default star and watch buttons 4 | code_user: OWASP 5 | code_repo: API-Security 6 | 7 | plugins: 8 | - jekyll-include-cache-0.2.0 9 | -------------------------------------------------------------------------------- /tab_roadmap.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: RoadMap 3 | layout: null 4 | tab: true 5 | order: 1 6 | tags: roadmap 7 | --- 8 | 9 | ## Planned Projects 10 | 11 | * API Security Top 10 12 | * API Security Cheat Sheet 13 | * crAPI - **C**ompletely **R**idiculous **API**, an intentionally vulnerable API 14 | project) 15 | 16 | ## Roadmap 17 | 18 | ![Roadmap][roadmap] 19 | 20 | [roadmap]: assets/images/roadmap.png 21 | -------------------------------------------------------------------------------- /announcements/cfd/2022/sample-data-submission.csv: -------------------------------------------------------------------------------- 1 | "NumberofAppsTested","CWE","NumberofAppsPer","TimePeriod","ContributorName","ContributorContactEmail","TypeofTesting","APIProtocol","PrimaryLanguage","Region","Industry","Retest" 2 | 100,20,53,2019,"Name","Email","TAH","REST","Node.js","North America","Retail","F" 3 | 100,20,10,2019,"Name","Email","TAH","GraphQL",".NET","North America","Technology","F" 4 | 100,20,30,2019,"Name","Email","TAH","gRPC","Go","North America","Technology","F" 5 | 100,425,5,2019,"Name","Email","TAH","SOAP","PHP","North America","Retail","F" 6 | -------------------------------------------------------------------------------- /.github/workflows/validate-owasp-metadata.yaml: -------------------------------------------------------------------------------- 1 | name: Validate OWASP entity metadata 2 | 3 | on: 4 | pull_request: 5 | paths: 6 | - '*.owasp.yaml' 7 | push: 8 | paths: 9 | - '*.owasp.yaml' 10 | 11 | concurrency: 12 | cancel-in-progress: true 13 | group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }} 14 | 15 | jobs: 16 | validate-metadata: 17 | runs-on: ubuntu-latest 18 | 19 | steps: 20 | - name: Checkout code 21 | uses: actions/checkout@v5 22 | 23 | - name: Validate metadata file 24 | uses: owasp/nest-schema/.github/actions/validate@a733198b4a942eb12d3ee8629cd9e0d409b1b2b9 25 | -------------------------------------------------------------------------------- /404.html: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | title: 404 - Not Found 4 | layout: col-generic 5 | 6 | --- 7 | 8 |
9 |

10 |

WHOA THAT PAGE CANNOT BE FOUND

11 |

Try the SEARCH function in the main navigation to find something. If you are looking for chapter information, please see Chapters for the correct chapter. For information about OWASP projects see Projects. For common attacks, vulnerabilities, or information about other community-led contributions see Contributed Content.

12 | 13 |
14 |

If all else fails you can search our historical site.

15 |
16 | -------------------------------------------------------------------------------- /tab_join.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: Join 3 | layout: null 4 | tab: true 5 | order: 1 6 | tags: join 7 | --- 8 | 9 | ## Google Group 10 | 11 | Join the discussion on the [OWASP API Security Project Google group][ml]. 12 | 13 | This is the best place to introduce yourself, ask questions, suggest and discuss 14 | any topic that is relevant to the project. 15 | 16 | ## GitHub Discussions 17 | 18 | You can also use [GitHub Discussions] as a place to connect with other community 19 | members, asking questions or sharing ideas. 20 | 21 | ## GitHub 22 | 23 | The project is maintained in the [OWASP API Security Project repo][repo]. 24 | 25 | **The latest changes are under the [`develop` branch][develop]**. 26 | 27 | Feel free to open or solve an [issue][issue]. 28 | 29 | Ready to contribute directly into the repo? Great! Just make sure you read the 30 | [How to Contribute guide][contributing]. 31 | 32 | [ml]: https://groups.google.com/a/owasp.org/d/forum/api-security-project 33 | [GitHub Discussions]: https://github.com/OWASP/API-Security/discussions 34 | [repo]: https://github.com/OWASP/API-Security 35 | [develop]: https://github.com/OWASP/API-Security/tree/develop 36 | [issue]: https://github.com/OWASP/API-Security/issues 37 | [contributing]: https://github.com/OWASP/API-Security/blob/master/CONTRIBUTING.md 38 | -------------------------------------------------------------------------------- /project.owasp.yaml: -------------------------------------------------------------------------------- 1 | audience: 2 | - breaker 3 | - builder 4 | - defender 5 | community: 6 | - name: project-api-top10 7 | platform: slack 8 | url: https://owasp.slack.com/archives/C0558AF1QQM 9 | description: Discussion of the OWASP API Top 10 Risks 10 | leaders: 11 | - name: Erez Yalon 12 | email: erez.yalon@owasp.org 13 | github: ErezYalon 14 | - name: Inon Shkedy 15 | email: inon.shkedy@owasp.org 16 | github: inonshk 17 | - name: Paulo Silva 18 | email: paulo.silva@owasp.org 19 | github: PauloASilva 20 | level: 3 21 | name: OWASP API Security Project 22 | pitch: > 23 | The API Security project focuses on strategies and solutions to understand 24 | and mitigate the unique vulnerabilities and security risks of Application 25 | Programming Interfaces (APIs) 26 | repositories: 27 | - name: www-project-api-security 28 | url: https://github.com/OWASP/www-project-api-security 29 | description: OWASP Foundation Web Repository 30 | - name: API-Security 31 | url: https://github.com/OWASP/API-Security 32 | description: OWASP API Security Project 33 | tags: 34 | - api 35 | - security 36 | - top10 37 | - translations 38 | - acknowledgments 39 | - join 40 | - roadmap 41 | - news 42 | type: documentation 43 | website: https://owasp.org/www-project-api-security 44 | -------------------------------------------------------------------------------- /info.md: -------------------------------------------------------------------------------- 1 | ### API Security Information 2 | 3 | 4 | 5 | 6 | 7 | ![Documentation Project][doc-proj-logo] 8 | 9 | Builders 10 | Breakers 11 | Defenders 12 | 13 | [![CC BY-SA 4.0][license-logo]{:width="175px"}][license] 14 | 15 | ### Downloads or Social Links 16 | 17 | * [API Security Top 10 2023][top10:2023] 18 | * [API Security Top 10 2019][top10:2019] ([PDF][pdf]) 19 | * [GraphQL Cheat Sheet][graphql-cs] 20 | * [GitHub Discussions] 21 | * [Mailing List][ml] 22 | 23 | ### Code Repository 24 | 25 | * [GitHub][github] 26 | 27 | [license]: http://creativecommons.org/licenses/by-sa/4.0/ 28 | [license-logo]: assets/images/by-sa.svg 29 | [doc-proj-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_documentation_project.svg?sanitize=true 30 | [top10:2023]: https://owasp.org/API-Security/editions/2023/en/0x00-header/ 31 | [top10:2019]: https://owasp.org/API-Security/editions/2019/en/0x00-header/ 32 | [pdf]: https://owasp.org/API-Security/editions/2019/en/dist/owasp-api-security-top-10.pdf 33 | [graphql-cs]: https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html 34 | [GitHub Discussions]: https://github.com/OWASP/API-Security/discussions 35 | [ml]: https://groups.google.com/a/owasp.org/d/forum/api-security-project 36 | [github]: https://github.com/OWASP/API-Security 37 | -------------------------------------------------------------------------------- /announcements/2023/02/api-top10-2023rc.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | layout: col-sidebar 4 | title: OWASP API Security Project 5 | tags: api security top10 translations acknowledgments join roadmap news 6 | 7 | --- 8 | 9 | [⌂ Home](/www-project-api-security) 10 | 11 | ## OWASP API Security Top 10 2023RC 12 | 13 | Dear security enthusiasts and developers, 14 | 15 | The OWASP API Security Project team is proud to announce the [OWASP API Security 16 | Top 10 2023 release candidate is now available][1]! The OWASP API Security Top 17 | 10 is a comprehensive guide to help organizations understand the risks and 18 | threats associated with their APIs and how to secure them. 19 | 20 | As a community-driven project, we are seeking contributions and feedback to 21 | help improve [the 2023 release candidate][1]. If you have expertise in API 22 | security, we encourage you to [review the OWASP API Security Top 10 on 23 | GitHub][1] and provide your comments and suggestions. Your contributions will 24 | play a crucial role in shaping the final version of the guide and making it as 25 | relevant and useful as possible. 26 | 27 | To contribute, simply [navigate to the OWASP API Security Top 10 2023 release 28 | candidate repository on GitHub][1] and submit your feedback through the issue 29 | tracker. If you have questions or would like to discuss the guide with others 30 | in the community, [join the OWASP API Security Project mailing list][2]. 31 | 32 | Let's work together to make API security more accessible and effective for 33 | everyone! 34 | 35 | Best regards,
36 | The OWASP API Security Project Team 37 | 38 | [1]: https://github.com/OWASP/API-Security/tree/master/2023/en/src 39 | [2]: https://groups.google.com/a/owasp.org/g/api-security-project 40 | -------------------------------------------------------------------------------- /announcements/cfd/2022/sample-data-submission.json: -------------------------------------------------------------------------------- 1 | { 2 | "contributions":{ 3 | "appData" : 4 | { 5 | "appsSubmitted":100 6 | }, 7 | "cwe":[ 8 | { 9 | "id":20, 10 | "occurances":53, 11 | "timePeriod":2019, 12 | "language":".NET", 13 | "region":"North America", 14 | "industry":"Retail", 15 | "retest":"F", 16 | "testingType":"TAH", 17 | "apiProtocol": "REST" 18 | }, 19 | { 20 | "id":20, 21 | "occurances":10, 22 | "timePeriod":2019, 23 | "language":".NET", 24 | "region":"North America", 25 | "industry":"Technology", 26 | "retest":"F", 27 | "testingType":"TAH", 28 | "apiProtocol": "GraphQL" 29 | }, 30 | { 31 | "id":20, 32 | "occurances":30, 33 | "timePeriod":2019, 34 | "language":"PHP", 35 | "region":"North America", 36 | "industry":"Technology", 37 | "retest":"F", 38 | "testingType":"TAH", 39 | "apiProtocol": "gRPC" 40 | }, 41 | { 42 | "id":425, 43 | "occurances":5, 44 | "timePeriod":2019, 45 | "language":".NET", 46 | "region":"North America", 47 | "industry":"Retail", 48 | "retest":"F", 49 | "testingType":"TAH", 50 | "apiProtocol": "SOAP" 51 | } 52 | ], 53 | "contributor":{ 54 | "name":"First Last", 55 | "email":"name@owasp.org" 56 | } 57 | } 58 | } -------------------------------------------------------------------------------- /announcements/cfd/2022/info.md: -------------------------------------------------------------------------------- 1 | ### API Security Information 2 | 3 | [![Lab Project][lab-proj-logo]{:height="66px"}][inc-proj] 4 | ![Documentation Project][doc-proj-logo] 5 | 6 | [![Builders][builders-logo]][builders] 7 | [![Breakers][breakers-logo]][breakers] 8 | [![Defenders][defenders-logo]][defenders] 9 | 10 | [![CC BY-SA 3.0][license-logo]{:width="175px"}][license] 11 | 12 | ### Downloads or Social Links 13 | 14 | * [API Security Top 10 2019 (PDF)][pdf] 15 | * [GraphQL Cheat Sheet][graphql-cs] 16 | * [Mailing List][ml] 17 | 18 | ### Code Repository 19 | 20 | * [GitHub][github] 21 | 22 | [inc-proj]: https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects 23 | [lab-proj-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_level_labs.svg?sanitize=true 24 | [builders]: https://www.owasp.org/index.php/Builders 25 | [builders-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_builders.svg?sanitize=true 26 | [breakers]: https://www.owasp.org/index.php/Breakers 27 | [breakers-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_breakers.svg?sanitize=true 28 | [defenders]: https://www.owasp.org/index.php/Defenders 29 | [defenders-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_defenders.svg?sanitize=true 30 | [license]: http://creativecommons.org/licenses/by-sa/3.0/ 31 | [license-logo]: assets/images/by-sa.svg 32 | [doc-proj-logo]: https://raw.githubusercontent.com/OWASP/www--site-theme/master/assets/images/common/owasp_documentation_project.svg?sanitize=true 33 | [pdf]: https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf 34 | [github]: https://github.com/OWASP/API-Security 35 | [ml]: https://groups.google.com/a/owasp.org/d/forum/api-security-project 36 | [graphql-cs]: https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html 37 | 38 | -------------------------------------------------------------------------------- /tab_acknowledgments.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: Acknowledgments 3 | layout: null 4 | tab: true 5 | order: 1 6 | tags: acknowledgments 7 | --- 8 | 9 | ## Founders 10 | 11 | * [Erez Yalon][erez-yalon] 12 | * [Inon Shkedy][inon-shkedy] 13 | 14 | ## Leaders 15 | 16 | * [Erez Yalon][erez-yalon] 17 | * [Inon Shkedy][inon-shkedy] 18 | * [Paulo Silva][paulo-silva] 19 | 20 | ## 2023 Sponsors 21 | 22 | ![Cequence Security][cequence]{:height="96px"} 23 | 24 | ![Checkmarx][checkmarx]{:height="96px"} 25 | 26 | ![Equixly][equixly]{:height="96px"} 27 | 28 | ![Impart Security][impart]{:height="96px"} 29 | 30 | ![Salt Security][salt]{:height="96px"} 31 | 32 | ![Traceable][traceable]{:height="96px"} 33 | 34 | ## 2023 Contributors 35 | 36 | 247arjun, abunuwas, Alissa Knight, Arik Atar, aymenfurter, Corey J. Ball, cyn8, 37 | d0znpp, Dan Gordon, donge, Dor Tumarkin, faizzaidi, gavjl, guybensimhon, Inês 38 | Martins, Isabelle Mauny, Ivan Novikov, jmanico, Juan Pablo, k7jto, LaurentCB, 39 | llegaz, Maxim Zavodchik, MrPRogers, planetlevel, rahulk22, Roey Eliyahu, Roshan 40 | Piyush, securitylevelup, sudeshgadewar123, Tatsuya-hasegawa, tebbers, vanderaj, 41 | wenz, xplo1t-sec, Yaniv Balmas, ynvb 42 | 43 | ## 2019 Contributors 44 | 45 | 007divyachawla, Abid Khan, Adam Fisher, anotherik, bkimminich, caseysoftware, 46 | Chris Westphal, dsopas, DSotnikov, emilva, ErezYalon, flascelles, Guillaume 47 | Benats, IgorSasovets, Inonshk, JonnySchnittger, jmanico, jmdx, Keith Casey, 48 | kozmic, LauraRosePorter, Matthieu Estrade, nathanawmk, PauloASilva, pentagramz, 49 | philippederyck, pleothaud, r00ter, Raj kumar, Sagar Popat, Stephen Gates, 50 | thomaskonrad, xycloops123, Raphael Hagi, Eduardo Bellis, Bruno Barbosa 51 | 52 | [erez-yalon]: https://www.owasp.org/index.php/User:ErezYalon 53 | [inon-shkedy]: https://www.owasp.org/index.php/User:Inon 54 | [paulo-silva]: https://www.owasp.org/index.php/User:PauloASilva 55 | [checkmarx]: assets/images/checkmarx-logo.png 56 | [salt]: assets/images/sponsors/salt.png 57 | [cequence]: assets/images/sponsors/cequence-security.png 58 | [traceable]: assets/images/sponsors/traceable.png 59 | [impart]: assets/images/sponsors/impart.png 60 | [checkmarx]: assets/images/sponsors/checkmarx.png 61 | [equixly]: assets/images/sponsors/equixly.png 62 | 63 | -------------------------------------------------------------------------------- /tab_news.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: News 3 | layout: null 4 | tab: true 5 | order: 1 6 | tags: news 7 | --- 8 | 9 | * **Jun 28th, 2024** 10 | 11 | OWASP API Security Project - Past Present and Future @ OWASP Global AppSec 12 | Lisbon 2024 ([YouTube][lisbon24]) 13 | * **Jun 3rd, 2024** 14 | 15 | [OWASP API Security Top 10 2023 French translation][top10-2023-fr] release. 16 | * **Jun 5th, 2023** 17 | 18 | [OWASP API Security Top 10 2023][top10:2023] stable version was publicly 19 | released. 20 | * **Feb 14, 2023** 21 | 22 | [OWASP API Security Top 10 2023 Release Candidate][2023rc-announcement] is 23 | now available. 24 | * **Aug 30, 2022** 25 | 26 | [OWASP API Security Top 10 2022 call for data](announcements/cfd/2022/) 27 | is open. 28 | * **Oct 30, 2020** 29 | 30 | [GraphQL Cheat Sheet][graphql-cs] release. 31 | A truly community effort whose [log and contributors list are available at 32 | GitHub][graphql-cs-pr]. 33 | * **Apr 4, 2020** 34 | 35 | [OWASP API Security Top 10 2019 pt-PT translation][top10-pt-PT] release. 36 | * **Mar 27, 2020** 37 | 38 | [OWASP API Security Top 10 2019 pt-BR translation][top10-pt-BR] release. 39 | * **Dec 26, 2019** 40 | 41 | OWASP API Security Top 10 2019 stable version release. 42 | * **Sep 30, 2019** 43 | 44 | The RC of API Security Top-10 List was published during [OWASP Global AppSec 45 | Amsterdam][ams] ([slide deck][ams-slides]) 46 | * **Sep 13, 2019** 47 | 48 | The RC of API Security Top-10 List was published during [OWASP Global AppSec 49 | DC][dc] ([slide deck][dc-slides]) 50 | * **May 30, 2019** 51 | 52 | The API Security Project was Kicked-Off during [OWASP Global AppSec Tel 53 | Aviv][telaviv] ([slide deck][telaviv-slides]) 54 | 55 | [ams]: https://ams.globalappsec.org/ 56 | [ams-slides]: https://github.com/OWASP/www-project-api-security/raw/master/assets/presentations/api-security-top10-rc-global-appsec-ams.pdf 57 | [dc]: https://dc.globalappsec.org/ 58 | [dc-slides]: https://github.com/OWASP/www-project-api-security/raw/master/assets/presentations/api-security-top10.pdf 59 | [telaviv]: https://telaviv.appsecglobal.org/ 60 | [telaviv-slides]: https://github.com/OWASP/www-project-api-security/raw/master/assets/presentations/owasp-api-security-project-kick-off.pdf 61 | [top10-pt-BR]: https://github.com/OWASP/API-Security/raw/master/2019/pt-br/dist/owasp-api-security-top-10-pt-br.pdf 62 | [top10-pt-PT]: https://github.com/OWASP/API-Security/raw/master/2019/pt-pt/dist/owasp-api-security-top-10.pdf 63 | [graphql-cs]: https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html 64 | [graphql-cs-pr]: https://github.com/OWASP/CheatSheetSeries/pull/434 65 | [2023rc-announcement]: announcements/2023/02/api-top10-2023rc 66 | [top10:2023]: https://owasp.org/API-Security/editions/2023/en/0x00-header/ 67 | [top10-2023-fr]: https://owasp.org/API-Security/editions/2023/fr/0x00-header/ 68 | [lisbon24]: https://www.youtube.com/watch?v=hn4mgTu5izg 69 | -------------------------------------------------------------------------------- /announcements/cfd/2022/index.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | layout: col-sidebar 4 | title: OWASP API Security Project 5 | tags: api security top10 translations acknowledgments join roadmap news 6 | 7 | --- 8 | 9 | [⌂ Home](/www-project-api-security) 10 | 11 | ## Call for Data 12 | 13 | The OWASP API Security Project team plans to build and release a new edition of 14 | the OWASP API Security Top 10 in 2022. 15 | 16 | This is the first time we're calling for data. Unlike in 2019 when the API 17 | Security Top 10 was first published, we believe the API industry is now more 18 | mature and should be able to contribute valuable data. 19 | 20 | ### Goals 21 | 22 | Collect comprehensive data regarding **API** vulnerabilities to-date in order 23 | to build a new top 10 of the most critical **API** security risks. 24 | 25 | ### Contributions 26 | 27 | To make things smoother we're adhering to the OWASP Top Ten Project 28 | contribution process and data contribution templates that most vendors/security 29 | practitioners are already familiar with. 30 | 31 | #### Contributors 32 | 33 | We're expecting data coming from a variety of sources, such as security 34 | vendors and consultancies, bug bounties programs, and security practitioners in 35 | general such as pentesters. 36 | 37 | #### Period 38 | 39 | This call for data will be open during September-November of 2022. 40 | 41 | Contribute data should date **from 2019 to the end of 2021** and it **should be 42 | API-specific** e.g. REST, GraphQL, gRPC, JSON-RPC, XML-RPC, etc. 43 | 44 | #### Process 45 | 46 | Data can be [uploaded here]. 47 | 48 | If for some reason you're not comfortable using the form to contribute data, 49 | please reach out to `paulo.silva@owasp.org` for an alternative method. 50 | 51 | #### Data Structure 52 | 53 | We're providing two submission templates: [CSV] and [JSON]. 54 | 55 | The data structure is very similar to the one used by the OWASP Top Ten Project 56 | with an additional attribute: `apiProtocol`. In case you already have automated 57 | tools to compile and output one of these file formats, you should be able to 58 | use it with little changes. 59 | 60 | ##### Per Dataset 61 | 62 | | Attribute | Required? | Description | 63 | | :-------- | :-------: | :---------- | 64 | | NumberofAppsTested | Yes | How many APIs were tested | 65 | | CWE | Yes | ID of the weakness found in tested APIs | 66 | | NumberofAppsPer | Yes | Number of APIs the CWE was found in | 67 | | TimePeriod | No | When (year) the weakness was first found: 2021/2020/2019 | 68 | | ContributorName | No | Who's contributing the data | 69 | | ContributorContactEmail | No | Email of who is contributing the data | 70 | | TypeofTesting | No | Type of test performed to identify the weakness: TaH1/HaT2/Tool | 71 | | APIProtocol | No | Type of API protocol: REST/GraphQL/gRPC/SOAP/... | 72 | | PrimaryLanguage | No | What programming language was used to implement the API logic | 73 | | Region | No | Global/North America/EU/Asia/Other | 74 | | Industry | No | Primary industry: Multiple/Financial/Industrial/Software/...| 75 | | Retest | No | Whether the data contains retests or the same applications multiple times: T/F | 76 | 77 | --- 78 | 79 | 1. Tool assisted Human 80 | 2. Human assisted Tool 81 | 82 | [uploaded here]: https://docs.google.com/forms/d/e/1FAIpQLSdcZU3cbkcGtpS9-2wMH0WMbT3H4ZFC9QOOSh2d0v67B2nUuA/viewform 83 | [CSV]: ./sample-data-submission.csv 84 | [JSON]: ./sample-data-submission.json 85 | -------------------------------------------------------------------------------- /tab_translations.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: Translations 3 | layout: null 4 | tab: true 5 | order: 1 6 | tags: translations 7 | --- 8 | 9 | ## OWASP API Security Top 10 2023 10 | 11 | * [Bahasa (Indonesian)][27] 12 | 13 | [Faiz Ahmed Zaidi] 14 | * [French][25] 15 | 16 | [Aurélien Troncy], [Laurent Legaz] 17 | * [Persian][26] 18 | 19 | [Alireza Mostame], [Maryam Javadi Hoseini], [Mohammad Reza Ismaeli Taba], 20 | [RNPG](https://www.linkedin.com/company/raspina-net-pars/){:rel="nofollow"} 21 | * [Português (Portugal)][28] 22 | 23 | [Rui Silva][rui-silva] 24 | 25 | ## OWASP API Security Top 10 2019 26 | 27 | * [Arabic][7] (also available in [PDF][8], [ODT][9]) 28 | 29 | [Malek Aldossary], [Sabri Hassanyah], [Mostafa Alaqsm], [Fahad Alduraibi], 30 | [Thamer Alshammeri], [Mohammed Alsuhaymi] 31 | * [French][13] (also available in [PDF][14], [ODT][15]) 32 | 33 | [Fred][datakime], [Laurent Legaz] 34 | * [German][22] (also available in [PDF][23], [ODT][24]) 35 | 36 | [Moritz Gruber][aware7-moritz], [Nick Lorenz], [Steffen Thamm], [Tim B.] 37 | * [Greek][19] ([PDF][20], [ODT][21]) 38 | 39 | [Athanasios Emmanouilidis], [Apostolos Giannakidis] 40 | * [Persian][16] (also available in [PDF][17], [ODT][18]) 41 | 42 | [Alireza Mostame], [Mohammad Reza Ismaeli Taba], [Amirmahdi Nowbakht], 43 | [RNPG](https://www.linkedin.com/company/raspina-net-pars/){:rel="nofollow"} 44 | * [Portuguese (Brazil)][1] (also available in [PDF][2], [ODT][3]) 45 | 46 | [Raphael Hagi][raphael-hagi], [Eduardo Bellis][eduardo-bellis], 47 | [Bruno Barbosa][bruno-barbosa] 48 | * [Portuguese (Portugal)][4] (also available in [PDF][5], [ODT][6]) 49 | 50 | [Paulo A. Silva][pauloasilva], [Rui Silva][rui-silva] 51 | * [Russian][10] (also available in [PDF][11], [ODT][12]) 52 | 53 | [Eugene Rojavski], [act1on3], keni0k 54 | 55 | [1]: https://owasp.org/API-Security/editions/2019/pt-BR/0x00-header/ 56 | [2]: https://owasp.org/API-Security/editions/2019/pt-BR/dist/owasp-api-security-top-10-pt-br.pdf 57 | [3]: https://owasp.org/API-Security/editions/2019/pt-BR/dist/owasp-api-security-top-10-pt-br.odt 58 | [4]: https://owasp.org/API-Security/editions/2019/pt-pt/0x00-header/ 59 | [5]: https://owasp.org/API-Security/editions/2019/pt-pt/dist/owasp-api-security-top-10.pdf 60 | [6]: https://owasp.org/API-Security/editions/2019/pt-pt/dist/owasp-api-security-top-10.odt 61 | [7]: https://owasp.org/API-Security/editions/2019/ar/0x00-header/ 62 | [8]: https://owasp.org/API-Security/editions/2019/ar/dist/owasp-api-security-top-10-ar.pdf 63 | [9]: https://owasp.org/API-Security/editions/2019/ar/dist/owasp-api-security-top-10-ar.odt 64 | [10]: https://owasp.org/API-Security/editions/2019/ru/0x00-header/ 65 | [11]: https://owasp.org/API-Security/editions/2019/ru/dist/owasp-api-security-top-10.pdf 66 | [12]: https://owasp.org/API-Security/editions/2019/ru/dist/owasp-api-security-top-10.odt 67 | [13]: https://owasp.org/API-Security/editions/2019/fr/0x00-header/ 68 | [14]: https://owasp.org/API-Security/editions/2019/fr/dist/owasp-api-security-top-10.pdf 69 | [15]: https://owasp.org/API-Security/editions/2019/fr/dist/owasp-api-security-top-10.odt 70 | [16]: https://owasp.org/API-Security/editions/2019/fa/0x00-header/ 71 | [17]: https://owasp.org/API-Security/editions/2019/fa/dist/owasp-api-security-top-10.pdf 72 | [18]: https://owasp.org/API-Security/editions/2019/fa/dist/owasp-api-security-top-10.odt 73 | [19]: https://owasp.org/API-Security/editions/2019/el-gr/0x00-header/ 74 | [20]: https://owasp.org/API-Security/editions/2019/el-gr/dist/owasp-api-security-top-10.pdf 75 | [21]: https://owasp.org/API-Security/editions/2019/el-gr/dist/owasp-api-security-top-10.odt 76 | [22]: https://owasp.org/API-Security/editions/2019/de/0x00-header/ 77 | [23]: https://owasp.org/API-Security/editions/2019/de/dist/owasp-api-security-top-10.pdf 78 | [24]: https://owasp.org/API-Security/editions/2019/de/dist/owasp-api-security-top-10.odt 79 | [25]: https://owasp.org/API-Security/editions/2023/fr/0x00-header/ 80 | [26]: https://owasp.org/API-Security/editions/2023/fa/0x00-header/ 81 | [27]: https://owasp.org/API-Security/editions/2023/id/0x00-header/ 82 | [28]: https://owasp.org/API-Security/editions/2023/pt-pt/0x00-header/ 83 | 84 | [raphael-hagi]: https://www.linkedin.com/in/raphael-hagi/ 85 | [eduardo-bellis]: https://www.linkedin.com/in/eduardo-bellis-92482534/ 86 | [bruno-barbosa]: https://www.linkedin.com/in/bbarbosa85/ 87 | [pauloasilva]: https://www.linkedin.com/in/devpauloasilva/ 88 | [rui-silva]: https://www.linkedin.com/in/rspro/ 89 | [Malek Aldossary]: http://twitter.com/malajab 90 | [Sabri Hassanyah]: https://twitter.com/kingsabri 91 | [Mostafa Alaqsm]: https://twitter.com/malaqsm 92 | [Fahad Alduraibi]: https://twitter.com/fahad_alduraibi 93 | [Thamer Alshammeri]: https://twitter.com/t44t_ 94 | [Mohammed Alsuhaymi]: https://twitter.com/msuhaymi 95 | [Eugene Rojavski]: https://twitter.com/eugenerojavski 96 | [act1on3]: https://twitter.com/act1on3 97 | [datakime]: https://github.com/datakime 98 | [Laurent Legaz]: https://github.com/llegaz 99 | [Alireza Mostame]: https://www.linkedin.com/in/alireza-mostame-29970b242 100 | [Mohammad Reza Ismaeli Taba]: https://www.linkedin.com/in/rezataba 101 | [Amirmahdi Nowbakht]: https://www.linkedin.com/in/amirmahdi-nowbakht-3b8865200 102 | [Athanasios Emmanouilidis]: https://www.linkedin.com/in/athanasiosem/ 103 | [Apostolos Giannakidis]: https://www.linkedin.com/in/giannakidisapostolos/ 104 | [aware7-moritz]: https://www.linkedin.com/in/moritz-gruber-734a43199/ 105 | [Steffen Thamm]: https://www.linkedin.com/in/steffen-thamm-a8341a27b/ 106 | [Nick Lorenz]: https://www.linkedin.com/in/nick-lorenz-16b211222/ 107 | [Tim B.]: https://www.linkedin.com/in/domai-tb/ 108 | [Aurélien Troncy]: https://www.linkedin.com/in/aur%C3%A9lien-troncy-214075229/ 109 | [Maryam Javadi Hoseini]: https://www.linkedin.com/in/maryam-javadi-353b1744/ 110 | [Faiz Ahmed Zaidi]: https://github.com/faizzaidi 111 | -------------------------------------------------------------------------------- /index.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | layout: col-sidebar 4 | title: OWASP API Security Project 5 | tags: api security top10 translations acknowledgments join roadmap news 6 | level: 3 7 | type: documentation 8 | pitch: The API Security project focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs) 9 | 10 | --- 11 | 12 |
13 |

14 | Check out the new 15 | 16 | OWASP API Security Top 10 2023 17 | ! 18 |

19 |
20 | 21 | ## What is API Security? 22 | 23 | A foundational element of innovation in today’s app-driven world is the API. 24 | From banks, retail and transportation to IoT, autonomous vehicles and smart 25 | cities, APIs are a critical part of modern mobile, SaaS and web applications and 26 | can be found in customer-facing, partner-facing and internal applications. By 27 | nature, APIs expose application logic and sensitive data such as Personally 28 | Identifiable Information (PII) and because of this have increasingly become a 29 | target for attackers. Without secure APIs, rapid innovation would be impossible. 30 | 31 | API Security focuses on strategies and solutions to understand and mitigate the 32 | unique vulnerabilities and security risks of Application Programming Interfaces 33 | (APIs). 34 | 35 | ## API Security Top 10 2023 36 | 37 | Here is a sneak peek of the 2023 version: 38 | 39 | * **[API1:2023 - Broken Object Level Authorization][API1:2023]** 40 | 41 | APIs tend to expose endpoints that handle object identifiers, creating a wide 42 | attack surface of Object Level Access Control issues. Object level 43 | authorization checks should be considered in every function that accesses a 44 | data source using an ID from the user. [Continue reading][API1:2023]. 45 | * **[API2:2023 - Broken Authentication][API2:2023]** 46 | 47 | Authentication mechanisms are often implemented incorrectly, allowing 48 | attackers to compromise authentication tokens or to exploit implementation 49 | flaws to assume other user's identities temporarily or permanently. 50 | Compromising a system's ability to identify the client/user, compromises API 51 | security overall. [Continue reading][API2:2023]. 52 | * **[API3:2023 - Broken Object Property Level Authorization][API3:2023]** 53 | 54 | This category combines [API3:2019 Excessive Data Exposure][API3:2019] and 55 | [API6:2019 - Mass Assignment][API6:2019], focusing on the root cause: the lack 56 | of or improper authorization validation at the object property level. This 57 | leads to information exposure or manipulation by unauthorized parties. 58 | [Continue reading][API3:2023]. 59 | * **[API4:2023 - Unrestricted Resource Consumption][API4:2023]** 60 | 61 | Satisfying API requests requires resources such as network bandwidth, CPU, 62 | memory, and storage. Other resources such as emails/SMS/phone calls or 63 | biometrics validation are made available by service providers via API 64 | integrations, and paid for per request. Successful attacks can lead to Denial 65 | of Service or an increase of operational costs. [Continue reading][API4:2023]. 66 | * **[API5:2023 - Broken Function Level Authorization][API5:2023]** 67 | 68 | Complex access control policies with different hierarchies, groups, and roles, 69 | and an unclear separation between administrative and regular functions, tend 70 | to lead to authorization flaws. By exploiting these issues, attackers can gain 71 | access to other users’ resources and/or administrative functions. [Continue 72 | reading][API5:2023]. 73 | * **[API6:2023 - Unrestricted Access to Sensitive Business Flows][API6:2023]** 74 | 75 | APIs vulnerable to this risk expose a business flow - such as buying a ticket, 76 | or posting a comment - without compensating for how the functionality could 77 | harm the business if used excessively in an automated manner. This doesn't 78 | necessarily come from implementation bugs. [Continue reading][API6:2023]. 79 | * **[API7:2023 - Server Side Request Forgery][API7:2023]** 80 | 81 | Server-Side Request Forgery (SSRF) flaws can occur when an API is fetching a 82 | remote resource without validating the user-supplied URI. This enables an 83 | attacker to coerce the application to send a crafted request to an unexpected 84 | destination, even when protected by a firewall or a VPN. [Continue 85 | reading][API7:2023]. 86 | * **[API8:2023 - Security Misconfiguration][API8:2023]** 87 | 88 | APIs and the systems supporting them typically contain complex configurations, 89 | meant to make the APIs more customizable. Software and DevOps engineers can 90 | miss these configurations, or don't follow security best practices when it 91 | comes to configuration, opening the door for different types of attacks. 92 | [Continue reading][API8:2023]. 93 | * **[API9:2023 - Improper Inventory Management][API9:2023]** 94 | 95 | APIs tend to expose more endpoints than traditional web applications, making 96 | proper and updated documentation highly important. A proper inventory of hosts 97 | and deployed API versions also are important to mitigate issues such as 98 | deprecated API versions and exposed debug endpoints. [Continue 99 | reading][API9:2023]. 100 | * **[API10:2023 - Unsafe Consumption of APIs][API10:2023]** 101 | 102 | Developers tend to trust data received from third-party APIs more than user 103 | input, and so tend to adopt weaker security standards. In order to compromise 104 | APIs, attackers go after integrated third-party services instead of trying to 105 | compromise the target API directly. [Continue reading][API10:2023]. 106 | 107 | ## Licensing 108 | 109 | **The OWASP API Security Project documents are free to use!** 110 | 111 | The OWASP API Security Project is licensed under the [Creative Commons 112 | Attribution-ShareAlike 4.0 license][license], so you can copy, distribute and 113 | transmit the work, and you can adapt it, and use it commercially, but all 114 | provided that you attribute the work and if you alter, transform, or build upon 115 | this work, you may distribute the resulting work only under the same or similar 116 | license to this one. 117 | 118 | [license]: https://creativecommons.org/licenses/by-sa/4.0/ 119 | [API1:2023]: https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ 120 | [API2:2023]: https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ 121 | [API3:2023]: https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/ 122 | [API3:2019]: https://owasp.org/API-Security/editions/2019/en/0xa3-excessive-data-exposure/ 123 | [API6:2019]: https://owasp.org/API-Security/editions/2019/en/0xa6-mass-assignment/ 124 | [API4:2023]: https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/ 125 | [API5:2023]: https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/ 126 | [API6:2023]: https://owasp.org/API-Security/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/ 127 | [API7:2023]: https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/ 128 | [API8:2023]: https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/ 129 | [API9:2023]: https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/ 130 | [API10:2023]: https://owasp.org/API-Security/editions/2023/en/0xaa-unsafe-consumption-of-apis/ 131 | -------------------------------------------------------------------------------- /assets/images/by-sa.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 19 | 21 | 43 | 45 | 46 | 48 | image/svg+xml 49 | 51 | 52 | 53 | 54 | 58 | 64 | 69 | 70 | 73 | 74 | 83 | 84 | 87 | 90 | 91 | 92 | 93 | 94 | 95 | 98 | 99 | 102 | 106 | 107 | 111 | 112 | 113 | 114 | 117 | 121 | 122 | 126 | 127 | 128 | 129 | 132 | 133 | 142 | 143 | 146 | 149 | 150 | 153 | 154 | 155 | 156 | 157 | 158 | 160 | 170 | 171 | 173 | 176 | 177 | 186 | 187 | 188 | 189 | 194 | 195 | 196 | 197 | 198 | 199 | 200 | --------------------------------------------------------------------------------