simpl.
Anmelden
Cybersicherheits-GRC 13 Punkte

API Security Assessment (OWASP API Top 10)

Diese Checkliste ist auf Englisch.

Assesses REST and GraphQL API security against the OWASP API Security Top 10 (2023), focusing on authorization, authentication, and resource controls.

OWASP API Security Top 10NIST 800-53

Kostenlos als PDF oder Word · E-Mail-Adresse eingeben und herunterladen.

Authorization

  • Is object-level authorization enforced so users can only access their own objects? *
  • Is function-level authorization enforced across all endpoints and methods? *
  • Are property-level authorization checks applied to prevent mass assignment? *

Authentication

  • Are authentication endpoints protected against credential stuffing and brute force? *
  • Are API tokens and keys short-lived, scoped, and securely stored? *
  • Is JWT signature and expiration validation enforced? *

Resource & Consumption Controls

  • Is rate limiting and throttling applied to prevent abuse? *
  • Are payload size, pagination, and query depth limits enforced? *
  • Are server-side request forgery risks mitigated on APIs that fetch remote resources? *

Inventory & Configuration

  • Is a complete inventory of API endpoints and versions maintained? *
  • Are deprecated and non-production API versions decommissioned? *
  • Are security misconfigurations (verbose errors, CORS, missing headers) remediated? *
  • Is data returned by APIs filtered to expose only necessary fields?

Vollständige Checkliste API Security Assessment (OWASP API Top 10) herunterladen

Kostenlos als übersichtliches, druckfertiges PDF oder als bearbeitbares Word-Dokument.