OWASP API Security Top 10 (2023): A Walk-through
The 2023 revision of the OWASP API Security Top 10 is sharper, more specific, and more useful than the 2019 version. It also reflects a long-running pattern: authorization is the dominant API risk. Here is the list with how each item is tested.
APIs · By Thimmagurudu Bathini · Published · 7 min read · Last reviewed
API1 Broken Object Level Authorization (BOLA)
Still number one. Every endpoint that takes an object identifier is a candidate. Deep dive in BOLA: still #1.
API2 Broken Authentication
Token leakage, predictable tokens, missing token expiry, replay attacks, JWT misuse. Covered in JWT attacks.
API3 Broken Object Property Level Authorization
New name in 2023, combining mass assignment and excessive data exposure. The endpoint either accepts properties it should not (write side) or returns properties it should not (read side). We test both directions.
API4 Unrestricted Resource Consumption
No rate limiting, no payload size limits, no query complexity limits (GraphQL), no pagination caps. Detail in rate limiting and API abuse.
API5 Broken Function Level Authorization
The endpoint exists, the user can reach it, but the function-level check is missing. Admin endpoints reachable from non-admin tokens.
API6 Unrestricted Access to Sensitive Business Flows
New for 2023. Specifically about business-logic abuse — sniping discount codes, scraping product data, abusing referral programs. Anti-automation, not authorization.
API7 Server Side Request Forgery
Now a top-10 API risk specifically. See SSRF in the cloud era.
API8 Security Misconfiguration
CORS too permissive, default credentials, debug endpoints, verbose errors leaking internals.
API9 Improper Inventory Management
Old API versions still live, undocumented endpoints discovered by attackers first, third-party APIs your app calls without monitoring.
API10 Unsafe Consumption of APIs
New for 2023. Your app consuming third-party APIs without validation — XML parsing of upstream data, deserialization, propagated injection.
See API security testing.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana