API Security Top 10 (2023) OWASP ne release kiya tha, jo batata hai ki APIs ko hack hone se kaise bachaya jaye. Isko aise samajhte hain ki ek school hai, jisme alag-alag darwaze (API endpoints) hain. Agar security tight nahi hai, to koi bhi andar ghus sakta hai. 

1. Broken Object Level Authorization (BOLA)

💡 Problem:

API properly check nahi karti ki jo user request kar raha hai, uska permission hai bhi ya nahi.
Attacker dusre users ke private data access kar sakta hai.

🔍 Example (Real-Life Scenario):

Maan lo ki ek medical app hai jo patient ka data store karti hai. API request aise hai:

Ab agar attacker ID change karke dusre patient ka data access kar le:

Aur API authorization check na kare, to attacker kisi bhi patient ka private medical record dekh sakta hai! 😱

✅ Solution:

• • • API me user authentication aur authorization check karo.

    • Object ID access control lagao (e.g., JWT tokens ya session-based checks).

    • Least privilege principle follow karo.

2. Broken Authentication

💡 Problem:

Agar authentication weak ho to attacker bina password ke bhi login kar sakta hai.
Iska phishing, brute force attack, session hijacking jese attacks me use hota hai.

🔍 Example:

Maan lo ek login API hai:

Agar password guessable hai ya brute force attack allowed hai, to hacker easily access le sakta hai. Ya agar JWT token expire nahi ho raha aur koi old token use kar sakta hai, to attacker usse bhi login kar sakta hai.

✅ Solution:

• • • Strong password policies rakho (minimum 12 characters, uppercase, lowercase, numbers, special chars).

    • MFA (Multi-Factor Authentication) implement karo.

    • Rate-limiting aur CAPTCHA lagao taaki brute force attack na ho.

    • Session expiration aur token revocation implement karo.

3. Broken Object Property Level Authorization (BOPLA)

💡 Problem:

Koi bhi extra sensitive fields modify ya access kar sakta hai jo API me exposed hai.

🔍 Example:

Maan lo ek API me user profile update hota hai:

Agar user manually “role”: “admin” set kar de aur API isko validate na kare, to ek normal user admin ban sakta hai! 😨

✅ Solution:

• • • API response me sirf authorized fields hi bhejo.

    • Backend me validate karo ki user sirf apne data ko modify kar sakta hai.

    • Role-based access control (RBAC) implement karo.

4. Unrestricted Resource Consumption

💡 Problem:

Agar API limit nahi karti ki ek user kitni baar request bhej sakta hai, to attacker DDoS attack kar sakta hai aur server crash ho sakta hai.

🔍 Example:

Maan lo ek API data fetch karti hai:

Agar koi bot baar-baar request bheje bina limit ke, to server overloaded ho jayega aur slow ya crash ho sakta hai.

✅ Solution:

• • • Rate limiting (e.g., 100 requests per minute per user) implement karo.

    • API quota aur resource consumption limits rakho.

    • Web Application Firewall (WAF) use karo taaki bots ko block kiya ja sake.

5. Broken Function Level Authorization

💡 Problem:

Koi bhi unauthorized function access kar sakta hai jo sirf admin ya specific users ke liye hona chahiye.

🔍 Example:

Ek normal user ke paas ek API call ka access hai:

Agar API proper role checking na kare, to koi bhi kisi bhi user ka account delete kar sakta hai. 😱

✅ Solution:

• • • Role-Based Access Control (RBAC) lagao.

    • Least privilege principle follow karo (jo jitna kaam karega, utni hi access mile).

    • Endpoints ko authenticate aur authorize karo.

6. Unrestricted Access to Sensitive Business Flows

💡 Problem:

Agar API business logic ka protection nahi karti, to attacker business rules ka bypass karke financial ya logical advantage le sakta hai.

🔍 Example:

Maan lo ek shopping app hai jisme coupon apply hota hai:

Agar attacker ye API baar-baar use kare bina limit ke, to wo unlimited free items le sakta hai!

✅ Solution:

• • • Coupon ya discount codes me limit lagao.

    • Business logic security check karo (e.g., ek user ek hi baar free coupon use kare).

    • API ke abuse ko detect karne ke liye logging aur monitoring karo.

7. Server-Side Request Forgery (SSRF)

💡 Problem:

Agar API bina validation ke kisi bhi external/internal URL ko call kar sake, to attacker internal network access le sakta hai.

🔍 Example:

Ek API request me URL diya jata hai:

Agar attacker is URL ko modify karke internal services ko access kar le, to wo sensitive data nikal sakta hai.

✅ Solution:

• • • External URL filtering aur allowlist use karo.

    • Internal IPs aur private endpoints ko block karo.

8. Security Misconfiguration

💡 Problem:

Agar API ka default debug mode enable hai ya extra data expose ho raha hai, to hacker easily exploit kar sakta hai.

🔍 Example:

Agar API error messages me internal details show ho rahe hain, jaise:

To attacker is data ka misuse karke database hack kar sakta hai! 😨

✅ Solution:

• • • Debug mode disable rakho.

    • Environment variables aur secret keys ko secure rakho.

    • Security headers implement karo.

9. Improper Inventory Management

💡 Problem:

Agar old APIs expose ho rahi hain jo deprecated ya unsecured hain, to hacker unka misuse kar sakta hai.

🔍 Example:

Agar ek old API api-v1 ab bhi active hai aur authentication ke bina access ho rahi hai, to attacker usko hack karke sensitive data nikal sakta hai.

✅ Solution:

• • • Old APIs ko remove ya secure karo.

    • API inventory maintain karo aur regular audits karo.

10. Unsafe Consumption of APIs

💡 Problem:

Agar third-party APIs bina verify kiye use ki ja rahi hain, to security risk badh jata hai.

🔍 Example:

Agar ek third-party API compromised hai, aur tum uska data bina verify kiye use kar rahe ho, to malware ya malicious data system me aa sakta hai.

✅ Solution:

• • • Third-party APIs ka review karo aur security check lagao.

    • Data validation aur sanitization implement karo.

🔥 Conclusion:
API security must hai! Har ek endpoint secure hona chahiye, authentication proper hona chahiye, aur rate-limiting aur authorization implement honi chahiye. 🚀