9. OWASP API security smoke tests
API Testing · 44 pages source format
API security is not optional. OWASP API Top 10 gives a checklist — broken auth, excessive data exposure, rate limits, injection.
What you'll learn
- OWASP API Top 10 overview
- AuthZ vs AuthN tests
- IDOR probes
- Security smoke in CI
OWASP API Top 10 skim
Broken Object Level Authorization (BOLA/IDOR), broken auth, excessive data exposure, lack of rate limiting.
Do this now
List Top 10. Pick 5 relevant to REST APIs you test.
AuthZ probe
Call endpoint as User A with User B resource id. Expect 403, not 200 with wrong data.
Do this now
If lab API supports auth, test wrong-role access. Else document probe pattern in SECURITY-SMOKE.md.
Sensitive data in responses
Passwords, tokens, internal IDs should not leak. Assert response excludes forbidden keys.
Do this now
Add test: user response must not contain password or passwordHash field.
Security smoke in suite
5–10 security smokes run every CI — not full pentest, but catch obvious regressions.
Do this now
Add security/ folder with 3 smoke tests or Postman folder. Document scope.