Build APIs that withstand real-world attacks. This two-day course covers REST and GraphQL security, BOLA/IDOR, authentication patterns, rate limiting, CORS, content validation, API gateway configuration, WebSocket security, and the full OWASP API Security Top 10. Hands-on against a vulnerable API.
Covers the full API attack surface from REST to GraphQL to WebSockets. Every module includes hands-on exercises against a vulnerable API endpoint. (Times are approximate.)
Design a REST API with security built in from the start. Cover resource naming, HTTP method semantics, status code hygiene, versioning, and the security implications of each design choice. Implement authentication, authorization, and input validation at the API layer.
GraphQL introduces its own attack surface: introspection disclosure, query depth attacks, batching abuse, and field-level authorization bypass. Disable introspection in production, implement query depth and complexity limits, and enforce field-level authorization. Hands-on against a vulnerable GraphQL endpoint.
Broken Object-Level Authorization (BOLA) is the number one API vulnerability. Exploit IDOR (Insecure Direct Object Reference) to access other users' data by manipulating IDs. Implement object-level authorization checks that verify the caller owns or has permission to access every resource.
Broken Object Property-Level Authorization means the API returns fields the caller should not see or accepts fields the caller should not set. Implement field-level filtering on responses and field-level validation on requests. Cover mass assignment as a special case of BOPLA.
Compare API authentication approaches: API keys, OAuth 2.0 bearer tokens, JWT, mTLS, and HMAC-signed requests. Understand the security properties, scalability, and operational complexity of each. Implement token-based authentication with proper validation and revocation.
Implement rate limiting to prevent brute force, credential stuffing, and API abuse. Cover token bucket, sliding window, and fixed window algorithms. Implement per-user, per-IP, and per-endpoint limits. Handle rate limit headers (Retry-After) and graceful degradation.
Cross-Origin Resource Sharing misconfiguration is one of the most common API security mistakes. Understand the preflight mechanism, credentialed requests, and wildcard risks. Implement a strict CORS policy that allows only the origins you intend.
APIs must validate the Content-Type of incoming requests and set the Content-Type of responses correctly. Exploit content-type confusion to bypass input validation. Implement strict content-type checking and response content-type headers that prevent MIME sniffing.
API error responses are a rich source of information leakage. Implement a consistent error response schema that provides enough information for the client to act without revealing internal details. Cover error codes, correlation IDs, and the distinction between client errors and server errors.
API gateways (Kong, AWS API Gateway, Azure APIM) provide centralized authentication, rate limiting, and threat protection. Configure gateway-level security policies. Understand what the gateway handles versus what the service must handle. Cover the risks of trusting the gateway too much.
Define security requirements in your OpenAPI specification using securitySchemes, security fields, and vendor extensions. Generate security documentation from the spec. Use the spec to drive automated security testing and contract validation.
WebSocket connections bypass many HTTP security controls. Cover origin validation, authentication on upgrade, message validation, rate limiting per connection, and the risks of long-lived unauthenticated connections. Implement a secure WebSocket endpoint with proper controls.
Use API fuzzing tools to discover unexpected behavior: malformed JSON, unexpected types, boundary values, and encoding variations. Integrate API security testing into CI/CD. Cover tools like Schemathesis, RESTler, and custom fuzzing scripts.
Given a REST API with multiple OWASP API Top 10 vulnerabilities, find each one, document it with a request/response example, and implement the fix. Score against the OWASP API Security Top 10. Debriefed as a group.
Review the API security checklist. Cover ongoing monitoring, API versioning and deprecation security, and how to maintain security as your API evolves.
Two days of hands-on API security covering REST, GraphQL, WebSockets and the OWASP API Security Top 10. For backend developers and API architects.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.