Api-Security

Complete API Security Resource Center Every API security guide on the site: REST and GraphQL testing, authentication and authorization, and the OWASP API Top 10. 🚀 Core API Vulnerability Prevention API Attack Surface Security API Security Guide OWASP API Top 10, 2026 GraphQL vulnerabilities, AI/MCP risks, comprehensive testing Rate limiting, authentication bypasses, API gateway hardening GraphQL Security Guide Injection techniques, authorization bypasses, introspection attacks Batching, DoS, subscriptions, engine-specific exploitation Modern API Protocols JWT Security Guide Algorithm confusion attacks, signature bypasses, library-specific exploits Token security, cryptographic attacks, secure implementation 🔐 API Authentication & Access Control Authentication Systems Authentication Guide ...

Comprehensive GraphQL Security Guide 🆕 Updated September 12, 2026 — added an airline GraphQL BOLA case study: sequential IDs, resolver-level authorization gaps, and why introspection removes the grace period. A practitioner’s reference for attacking and defending GraphQL APIs — discovery, introspection, schema recovery, injection, authorization flaws, batching, DoS, subscriptions, CSRF/CSWSH, engine-specific quirks, and detection/prevention. Table of Contents Fundamentals Discovery & Fingerprinting Introspection Schema Recovery Without Introspection Query & Data Extraction Mutations & Mass Assignment Authorization Flaws (BOLA / BFLA / IDOR) Injection Through GraphQL Batching Attacks & Aliases Denial of Service CSRF & CSWSH Subscriptions & WebSockets Engine-Specific Notes (Apollo, Hasura, graphql-java, async-graphql, Mercurius) Notable CVEs & Real-World Chains Tooling Detection & Prevention Payload Quick Reference 1. Fundamentals GraphQL is a query language and server runtime for APIs, originally developed at Facebook and open-sourced in 2015. Instead of the multiple fixed endpoints of a REST API, a GraphQL service exposes a single endpoint that accepts typed queries and returns exactly the fields the client asks for. ...

API security testing checklist and guide Testing an API right now? Jump to the API security testing checklist: recon, auth and every OWASP API Top 10 risk as tick boxes. For authorization alone, the BOLA, BFLA & BOPLA testing checklist is the two-account, copy-paste version. 🆕 Updated September 12, 2026 — added the Flowise case study: AI workflow APIs that execute user code by design, and why insufficient patches deserve a re-test. ...

The quick-reference authorization checklist Broken authorization is the number one bug class in APIs, and it has three faces. This is the scannable checklist I run through when I’m testing an API for it — definitions, setup, and copy-paste test steps for each. For the full exploitation depth (every bypass primitive, parser quirks, real CVEs) see the API Security guide; for the rest of an API test (recon, auth, rate limits, GraphQL, JWT) use its full API security testing checklist. This page is the authorization checklist that sits next to it. ...