WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2025 • Aug 20, 2025 • Session details

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Are your APIs bleeding data through mass assignment or faulty authorization? Master the OWASP Top Ten to embed bullet-proof defense mechanisms directly into your architecture.

Pause
Mute Enter Fullscreen
#1 about 2 min

Overview of the OWASP API security top ten

Assembly of the API security list relies on public incident data to raise awareness about common vulnerabilities.

#2 about 3 min

Preventing broken object level authorization in APIs

Hardcoding or guessing resource IDs without mandatory permission checks grants unauthorized access to sensitive user data.

#3 about 6 min

Securing JSON web tokens against broken authentication

Misconfigured token signatures and shared secrets require strict validation and secure backend-for-frontend patterns for single page applications.

#4 about 4 min

Mitigating broken object property level authorization and mass assignment

Unrestricted model binding allows attackers to overwrite restricted object properties like creation dates unless stopped by specific allow lists.

#5 about 4 min

Handling unrestricted resource consumption and query batching

Rate limiting and strict pagination boundaries protect API endpoints from denial of service attacks via overloaded background queries.

#6 about 1 min

Enforcing broken function level authorization across HTTP methods

Failing to secure alternate HTTP methods like POST leaves restricted endpoints vulnerable despite enforcing checks on standard GET requests.

#7 about 2 min

Restricting access to sensitive business flows

Threat modeling and processional countermeasures like canceling duplicate transactions prevent structural abuse of API business logic.

#8 about 3 min

Understanding server side request forgery attacks

Unrestricted intermediate servers can be leveraged to access internal network resources by forwarding forged attacker requests.

#9 about 3 min

Fixing security misconfigurations and revealing HTTP headers

Implementing explicit security headers and removing framework version numbers eliminates obvious exploitation paths for attackers.

#10 about 2 min

Implementing proper API inventory management and sunsetting processes

Documenting forgotten test servers and enforcing strict version retirement processes minimizes the unmaintained attack surface.

#11 about 2 min

Defending against unsafe consumption of third party APIs

Treating external API responses as untrusted user input guarantees resilience against unexpected failures or maliciously injected payloads.

Matching moments

6:11 min

Overview of the 2025 OWASP Top Ten list

Christian Wenz Christian Wenz · WWC Europe 2026

12:11 min

Identifying and mitigating top software vulnerability classes

Thomas Konrad · WWC 2021

3:15 min

The current state of enterprise APIs and security trends

Pratim Bhosale Pratim Bhosale · WWC 2025

41 sec

Identifying missing security risks beyond the top ten

Christian Wenz Christian Wenz · WWC Europe 2026

2:00 min

Key architectural takeaways for building secure APIs

Philippe De Ryck · LIVE

3:26 min

Designing APIs for security from day one

Philippe De Ryck · LIVE

More from World Congress 2025

GenAI Security: Navigating the Unseen Iceberg thumbnail
24:33
10 months ago

GenAI Security: Navigating the Unseen Iceberg

Maish Saidel-Keesing

Behind the Code: How Women Are Powering the Future of AI thumbnail
30:28
12 months ago

Behind the Code: How Women Are Powering the Future of AI

Alexandra Wudel, Laura Moritz, Madalina Florean

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise? thumbnail
28:12
12 months ago

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise?

Justus Lumpe, Konstantin Vinogradov, Nils Eiteneyer, Stephan Wirris

AI in Leadership: How Technology is Reshaping Executive Roles thumbnail
28:19
12 months ago

AI in Leadership: How Technology is Reshaping Executive Roles

Bernd Datler, Jasmin Kaiser, Jeff Hausmann, Sonja Alvarez

The AI-Ready Stack: Rethinking the Engineering Org of the Future thumbnail
28:09
12 months ago

The AI-Ready Stack: Rethinking the Engineering Org of the Future

Alex Laubscher, Jan Oberhauser, Keno Dreßel, Mirko Novakovic

AI Sovereignty: What Does It Take? thumbnail
29:13
12 months ago

AI Sovereignty: What Does It Take?

Boris Hecker, Clemens Wasner, Robin Hermann, Sonja Alvarez

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Designing APIs That Survive AI Agents at Scale

Phani Pendurthi

Mastercard, Principal Software Engineer

Phani Pendurthi
Open session

World Congress 2026 North America

API = Some REST and HTTP, right? RIGHT?!

Rustam Mehmandarov

Passionate computer scientist

Rustam Mehmandarov
Open session

World Congress 2026 North America

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

Related videos

Bulletproof Web Applications: The 2025 OWASP Top Ten thumbnail
25:29
WWC Europe 2026 • about 1 month ago

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

Architecting API Security thumbnail
47:34
LIVE • over 4 years ago

Architecting API Security

Philippe De Ryck

Lessons learned from observing a billion API requests thumbnail
23:47
WWC 2025 • 12 months ago

Lessons learned from observing a billion API requests

Pratim Bhosale

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
WWC 2023 • almost 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

An Opinionated Guide to Bulletproof APIs thumbnail
27:13
WWC Europe 2026 • about 1 month ago

An Opinionated Guide to Bulletproof APIs

Rustam Mehmandarov

101 Typical Security Pitfalls thumbnail
28:41
WWC 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.