Browsing Tag
api
53 posts
JSON Web Tokens (JWT) Security: Everything I Check When Testing JWT-Based APIs
JSON Web Tokens are everywhere in modern API authentication, and that’s exactly why I spend so much time…
Information Disclosure in APIs: How I Find Data Leaks Before Attackers Do
Information disclosure is one of the quietest categories of API vulnerabilities, and that’s exactly what makes it dangerous.…
Broken Object Level Authorization (BOLA): My Step-by-Step Testing Guide for API’s #1 Vulnerability
If I had to pick the single most common and most damaging API vulnerability I come across, it…
Broken User Authentication in APIs: My Full Testing Checklist
Authentication is the front door of any API, and Broken User Authentication is what happens when that door…
Excessive Data Exposure in APIs: How I Catch APIs That Reveal More Than They Should
Excessive Data Exposure happens in a very specific and very common way: a developer builds an API endpoint,…
When to Use an API Description Format: OpenAPI, RAML, and API Blueprint Explained
If you have ever opened a random API’s documentation and felt completely lost, you already know why API…
API Security and User Management: A Practical Guide to Keeping Your API and Users Safe
Every API I’ve ever worked on eventually asks the same two questions: who is calling me, and are…
Legal Considerations for Your API Strategy: What Every API Owner Needs to Know
When I first started shipping public APIs, I was almost entirely focused on the technical side — uptime,…
Which API Features You Should Test: A Complete API Testing Checklist
I’ve shipped APIs that looked perfect in code review and still broke in production because nobody tested the…
Threat Modeling an API Test: A Step-by-Step Guide to Thinking Like an Attacker
Testing an API for bugs is one thing. Testing it against someone who actually wants to break in…