API Security Checklist

What this checklist is

An API security checklist you can run against a real codebase before a release. It is built on the OWASP API Security Top 10 (2023 edition) and the OWASP cheat sheets, and every check says how much it matters and exactly how to verify it.

It has 7 chapters and 35 checks, each with how to verify it and how much it matters. For backend and full-stack developers.

Chapter by chapter

1. Authentication (5 checks)

Checks that every request proves who is calling, and that tokens and login flows cannot be abused (OWASP API2:2023).

2. Object, property and function level authorization (5 checks)

Checks that a logged-in user can only reach their own objects, fields and functions (OWASP API1, API3 and API5:2023).

3. Rate limiting and resource limits (5 checks)

Checks that no single client can exhaust your servers, your database or your bill (OWASP API4 and API6:2023).

4. Input validation, injection and SSRF (6 checks)

Checks that every input is validated on the server and that URL-fetching features cannot be pointed at your internal network (OWASP API7 and API10:2023).

5. TLS, CORS and security headers (4 checks)

Checks on how the API is reached: encrypted transport, which origins may call it from a browser, and the headers that go with each response.

6. Error handling, logging and monitoring (5 checks)

Checks that errors tell attackers nothing useful, and that your logs tell you when something is wrong.

7. Inventory, versioning and configuration (5 checks)

Checks that you know every API host and version you run, and that none of them are left with debug settings or open admin access (OWASP API8 and API9:2023).

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (6 cited).