---

name: api-security-testing description: API security testing principles. OWASP API Top 10, authentication, authorization testing.

API Security Testing

---

1. OWASP API Security Top 10

Testing Focus by Category

---

2. Authentication Testing

JWT Testing Principles

Session Testing

---

3. Authorization Testing

Testing Patterns

BOLA/IDOR Testing

1. Identify resource IDs in requests
2. Capture request with user A's session
3. Replay with user B's session
4. Check for unauthorized access

---

4. Input Validation Testing

Injection Types

Testing Approach

• Test all input parameters
• Try type coercion
• Test boundary values
• Check error messages

---

5. Rate Limiting Testing

What to Test

Bypass Techniques to Test

• X-Forwarded-For header
• Different HTTP methods
• Case variations in endpoints
• API versioning differences

---

6. GraphQL Security

Specific Tests

---

7. API Discovery

Finding Undocumented APIs

---

8. Testing Checklist

Authentication

• Test for bypass
• Check credential strength
• Verify token security
• Test logout

Authorization

• Test BOLA/IDOR
• Check privilege escalation
• Verify function access

Input

• Test all parameters
• Check for injection
• Verify validation

Security Config

• Check CORS
• Verify headers
• Test error handling

---

9. Anti-Patterns

---