Security

API Security Best Practices roadmap

Secure APIs against the OWASP API Security Top 10: authentication, authorization, input, abuse, transport and monitoring.

What you will learn

1. Authentication FundamentalsOptional
How web apps keep users signed in with sessions, cookies and tokens, and how XSS and CSRF attacks abuse them.
- Sessions, Cookies, OAuth & JWT — Backend Engineering · Sessions, Cookies, OAuth & JWT
- XSS & CSRF — Security · XSS & CSRF
2. API Security Best Practices
Use the OWASP API Security Top 10 to secure authentication and tokens, enforce object- and function-level authorization, and validate input against mass assignment.
- OWASP API Security Top 10 — API Security · OWASP API Security Top 10
- API Authentication & Tokens — API Security · API Authentication & Tokens
- BOLA & BFLA (Authorization) — API Security · BOLA & BFLA (Authorization)
- Input Validation & Mass Assignment — API Security · Input Validation & Mass Assignment
3. API Hardening & Monitoring
Limit abuse with rate limits, lock down transport, CORS and secrets, and log and monitor APIs to detect attacks.
- Rate Limiting & Abuse — API Security · Rate Limiting & Abuse
- TLS, CORS & Secrets — API Security · TLS, CORS & Secrets
- API Logging & Monitoring — API Security · API Logging & Monitoring

Each step unlocks when you answer its questions well enough, and a module you finish counts in every roadmap that shares it.