Securing APIs end to end — authentication, authorization, rate limiting, input validation, and the OWASP API risks that matter most.
Why APIs became the primary attack surface, how API risk differs from classic web-app risk, and the OWASP API Security Top 10 framework this series builds on.
The opener to an API security series: why APIs are the primary attack surface, the OWASP API Security Top 10 (BOLA, broken auth, BFLA, SSRF, misconfiguration, inventory…), how API security differs from web-app security, and how to threat-model an API.
The second post in the API Security series — a practical tour of API keys, session cookies, bearer tokens, OAuth 2.0, OIDC and JWTs, plus how to verify a token correctly and where authentication quietly breaks.
Proving who is calling: API keys vs sessions vs bearer tokens, OAuth 2.0 grant types and OIDC, and JWT validation done right — the alg:none / algorithm-confusion pitfalls, verifying signature/exp/aud/iss, and access vs refresh token rotation.
Why the biggest class of API bugs is not about who you are but about what you are allowed to touch — and how to check ownership, function access, and property access on every single request.
The dominant class of API bugs: broken object level authorization (BOLA/IDOR — the #1 API risk), broken function level authorization, and object property level (mass assignment / excessive data exposure) — with allow-listed DTOs, ownership checks, and deny-by-default.
Part four of the API Security series: treat every byte crossing the boundary as hostile, validate against a schema you control, parameterize at the data sink, and never let a client-supplied URL become a pivot into your network.
Treating every input as hostile: schema/DTO validation (allow-list, reject unknown fields), injection defenses (parameterized queries), and SSRF — allow-listing destinations and blocking internal/link-local ranges including via redirects.
Part five of the API Security series: why limits are a security control and not just an ops knob, how the four rate-limiting algorithms trade off, which dimensions to key on, and how to protect expensive queries and sensitive business flows from bulk abuse.
Rate limiting as a security control (OWASP API4/API6): the algorithms and their trade-offs, keying on authenticated identity not just IP, 429 + Retry-After, protecting expensive operations, and defending sensitive business flows from bulk abuse.
Part six of the API Security series: encrypt every byte in transit and at rest, hand out only the data a caller actually needs, and keep the keys that protect it out of your code and under a rotation policy.
Protecting data in transit and at rest: TLS everywhere (even internal, zero-trust), mTLS for service-to-service, minimizing sensitive data exposure, encryption at rest with managed keys, secrets management, a correct CORS allow-list, and redacting logs.
Part seven of the API Security series: the perimeter and runtime layer that enforces security consistently — the gateway as a policy enforcement point, the limits of a WAF, keeping an honest inventory of every endpoint you expose, hardening defaults, and watching the traffic for abuse you can only see at runtime.
The perimeter and runtime layer: the API gateway as a policy enforcement point (and why it can't replace per-service authz), WAF limits, improper inventory management (shadow/zombie APIs), security misconfiguration, and runtime detection.
The finale of the API Security series — how to bake security into the way APIs are designed, built, tested, shipped, and operated, so that every control from the previous seven posts becomes a repeatable part of the pipeline instead of a one-time heroic effort.
The capstone: baking security into the API lifecycle — shift-left threat modeling, CI gates (SAST, SCA, secret scanning, spec-driven authz/BOLA and DAST tests that fail the build), an OWASP-API-Top-10-to-control map, and incident response.
This series is part of a larger body of work by Pratik Dhanave, an Agentic AI Architect writing about production AI systems, distributed systems, and cloud-native engineering. Explore all course series, browse every post, or find topics via the tag index.