API security review
Twelve checks against an API you are allowed to test, ordered so that each one builds on what the previous established. Identity first, because a finding about rate limits means something different depending on who the limit applies to. Then what the API accepts, then what it reveals when it refuses. Run these against your own service or one you have written permission to test, on a staging environment where a mistake costs nothing, and keep every request single unless the item says otherwise.
12 checksabout 68 min end to end
Identity
- How to test API authentication
Establish how the service decides who is calling before testing anything it protects. - How to verify JWT signature
Decoding is not verifying, and a service that confuses the two accepts forged tokens. - How to check JWT algorithm
The alg field is attacker-controlled input until the server pins what it will accept. - How to check JWT expiration
A token with no expiry cannot be ended by waiting, only by revocation you may not have built. - How to decode JWT
Read the claims the service actually trusts before trusting them in production.
Who may call it from where
- How to check CORS configuration
A reflected origin combined with credentials hands the session to any page that asks. - How to test preflight request
The preflight and the real request are answered by different code, so one can pass while the other fails. - How to check rate limit headers
Read the quota the API publishes before spending it, and know whether the limit is per key or per address. - How to test API rate limiting
A published limit that is not enforced is documentation, and the only way to tell is to reach it.
What it accepts and what it says
- How to test API with invalid input
Invalid parameters that are silently ignored turn a rejected request into a successful wrong one. - How to test API error responses
An error body that leaks a stack trace tells an attacker your framework, your paths and your versions. - How to check content-type of API response
An HTML error page served with a JSON content type passes a status check and crashes the client.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.