# API Security Testing

> Principles for testing API security. OWASP API Top 10, authentication, authorization testing.

---

## OWASP API Security Top 10

| Vulnerability                  | Test Focus                     |
| ------------------------------ | ------------------------------ |
| **API1: BOLA**                 | Access other users' resources  |
| **API2: Broken Auth**          | JWT, session, credentials      |
| **API3: Property Auth**        | Mass assignment, data exposure |
| **API4: Resource Consumption** | Rate limiting, DoS             |
| **API5: Function Auth**        | Admin endpoints, role bypass   |
| **API6: Business Flow**        | Logic abuse, automation        |
| **API7: SSRF**                 | Internal network access        |
| **API8: Misconfiguration**     | Debug endpoints, CORS          |
| **API9: Inventory**            | Shadow APIs, old versions      |
| **API10: Unsafe Consumption**  | Third-party API trust          |

---

## Authentication Testing

### JWT Testing

| Check     | What to Test                 |
| --------- | ---------------------------- |
| Algorithm | None, algorithm confusion    |
| Secret    | Weak secrets, brute force    |
| Claims    | Expiration, issuer, audience |
| Signature | Manipulation, key injection  |

### Session Testing

| Check        | What to Test         |
| ------------ | -------------------- |
| Generation   | Predictability       |
| Storage      | Client-side security |
| Expiration   | Timeout enforcement  |
| Invalidation | Logout effectiveness |

---

## Authorization Testing

| Test Type      | Approach                          |
| -------------- | --------------------------------- |
| **Horizontal** | Access peer users' data           |
| **Vertical**   | Access higher privilege functions |
| **Context**    | Access outside allowed scope      |

### BOLA/IDOR Testing

1. Identify resource IDs in requests
2. Capture request with user A's session
3. Replay with user B's session
4. Check for unauthorized access

---

## Input Validation Testing

| Injection Type | Test Focus         |
| -------------- | ------------------ |
| SQL            | Query manipulation |
| NoSQL          | Document queries   |
| Command        | System commands    |
| LDAP           | Directory queries  |

**Approach:** Test all parameters, try type coercion, test boundaries, check error messages.

---

## Rate Limiting Testing

| Aspect    | Check                    |
| --------- | ------------------------ |
| Existence | Is there any limit?      |
| Bypass    | Headers, IP rotation     |
| Scope     | Per-user, per-IP, global |

**Bypass techniques:** X-Forwarded-For, different HTTP methods, case variations, API versioning.

---

## GraphQL Security

| Test          | Focus              |
| ------------- | ------------------ |
| Introspection | Schema disclosure  |
| Batching      | Query DoS          |
| Nesting       | Depth-based DoS    |
| Authorization | Field-level access |

---

## Security Testing Checklist

**Authentication:**

- [ ] Test for bypass
- [ ] Check credential strength
- [ ] Verify token security

**Authorization:**

- [ ] Test BOLA/IDOR
- [ ] Check privilege escalation
- [ ] Verify function access

**Input:**

- [ ] Test all parameters
- [ ] Check for injection

**Config:**

- [ ] Check CORS
- [ ] Verify headers
- [ ] Test error handling

---

> **Remember:** APIs are the backbone of modern apps. Test them like attackers will.