simpl.
로그인
사이버보안 GRC 13개 항목

API Security Assessment (OWASP API Top 10)

이 체크리스트는 영어로 제공됩니다.

Assesses REST and GraphQL API security against the OWASP API Security Top 10 (2023), focusing on authorization, authentication, and resource controls.

OWASP API Security Top 10NIST 800-53

무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.

Authorization

  • Is object-level authorization enforced so users can only access their own objects? *
  • Is function-level authorization enforced across all endpoints and methods? *
  • Are property-level authorization checks applied to prevent mass assignment? *

Authentication

  • Are authentication endpoints protected against credential stuffing and brute force? *
  • Are API tokens and keys short-lived, scoped, and securely stored? *
  • Is JWT signature and expiration validation enforced? *

Resource & Consumption Controls

  • Is rate limiting and throttling applied to prevent abuse? *
  • Are payload size, pagination, and query depth limits enforced? *
  • Are server-side request forgery risks mitigated on APIs that fetch remote resources? *

Inventory & Configuration

  • Is a complete inventory of API endpoints and versions maintained? *
  • Are deprecated and non-production API versions decommissioned? *
  • Are security misconfigurations (verbose errors, CORS, missing headers) remediated? *
  • Is data returned by APIs filtered to expose only necessary fields?

API Security Assessment (OWASP API Top 10) 체크리스트 전체 다운로드

인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.