simpl.
Connexion
GRC Cybersécurité 13 points

API Security Assessment (OWASP API Top 10)

Cette liste de contrôle est en anglais.

Assesses REST and GraphQL API security against the OWASP API Security Top 10 (2023), focusing on authorization, authentication, and resource controls.

OWASP API Security Top 10NIST 800-53

PDF ou Word gratuit · saisissez votre e-mail pour le télécharger.

Authorization

  • Is object-level authorization enforced so users can only access their own objects? *
  • Is function-level authorization enforced across all endpoints and methods? *
  • Are property-level authorization checks applied to prevent mass assignment? *

Authentication

  • Are authentication endpoints protected against credential stuffing and brute force? *
  • Are API tokens and keys short-lived, scoped, and securely stored? *
  • Is JWT signature and expiration validation enforced? *

Resource & Consumption Controls

  • Is rate limiting and throttling applied to prevent abuse? *
  • Are payload size, pagination, and query depth limits enforced? *
  • Are server-side request forgery risks mitigated on APIs that fetch remote resources? *

Inventory & Configuration

  • Is a complete inventory of API endpoints and versions maintained? *
  • Are deprecated and non-production API versions decommissioned? *
  • Are security misconfigurations (verbose errors, CORS, missing headers) remediated? *
  • Is data returned by APIs filtered to expose only necessary fields?

Téléchargez la liste de contrôle API Security Assessment (OWASP API Top 10) complète

Obtenez-la gratuitement en PDF propre et imprimable, ou en document Word modifiable.