API Security Checklist

Chapter 1 of 7 · 5 checks · 2 min

Authentication

Checks that every request proves who is calling, and that tokens and login flows cannot be abused (OWASP API2:2023).

Show
  1. Every non-public endpoint rejects requests without valid credentialsMust

    Why it matters and how to check

    Authentication should be on by default, with public endpoints listed explicitly. When each route adds its own check, one forgotten route exposes data. OWASP's REST cheat sheet says to enforce access control at every non-public endpoint.

    To verify: list every route from your router or OpenAPI file. Call each non-public one with no token, an expired token and a token with a broken signature. All should return 401. Add an automated test that walks the route list so new routes are covered too.

    Example

    Shell
    curl -i https://api.example.com/v1/orders
# expect: HTTP/1.1 401 Unauthorized

curl -i -H "Authorization: Bearer expired.or.tampered.token" \
  https://api.example.com/v1/orders
  2. JWTs are verified for signature, algorithm, issuer, audience and expiryMust

    Why it matters and how to check

    Decoding a JWT is not verifying it. OWASP says to reject unsigned tokens (alg: none), choose the algorithm from server configuration rather than the token header, and check iss, aud and exp.

    To verify: send a token with alg set to none, a token signed with a different key, one for another audience, and one that has expired. Each must be rejected with 401. In code, confirm the verify call pins the allowed algorithms.

    Example

    TypeScript
    import { jwtVerify } from 'jose';

const { payload } = await jwtVerify(token, publicKey, {
  algorithms: ['RS256'],
  issuer: 'https://auth.example.com/',
  audience: 'api.example.com',
});
  3. Login, OTP and password reset endpoints are rate limitedMust

    Why it matters and how to check

    Authentication endpoints are where attackers try credential stuffing and brute force. OWASP's API4 guidance calls out throttling sensitive operations such as OTP validation and password recovery.

    To verify: send 50 wrong passwords for one account in a minute, then 50 attempts across different accounts from one IP. Both should start returning 429 (or trigger a CAPTCHA or temporary lock) well before the end. Check that reset and OTP endpoints behave the same, and that the limit is enforced on the server, not only in the UI.

  4. Tokens, API keys and passwords never travel in URLsMust

    Why it matters and how to check

    URLs are written to server logs, proxy logs, browser history and analytics. OWASP's REST cheat sheet says to send credentials in headers or request bodies instead.

    To verify: search your API client code and docs for query parameters such as token=, api_key= or password=. Then search a day of access logs for the same patterns. Any hit should be moved to an Authorization header, and the exposed values rotated.

  5. Access tokens are short-lived and can be revokedShould

    Why it matters and how to check

    A token that lasts a month gives an attacker a month. Short-lived access tokens (minutes to an hour) with refresh tokens limit the damage of a leak, and logout or a password change should actually end sessions. OWASP suggests deny-listing a token's jti on logout until it expires.

    To verify: decode an access token and check exp minus iat. Log out, then replay the old token: it should fail. Change the password on one device and confirm the other device's session ends.