WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2025 • Aug 20, 2025 • Session details

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Are your APIs bleeding data through mass assignment or faulty authorization? Master the OWASP Top Ten to embed bullet-proof defense mechanisms directly into your architecture.

Pause
Mute Enter Fullscreen
#1 about 2 min

Overview of the OWASP API security top ten

Assembly of the API security list relies on public incident data to raise awareness about common vulnerabilities.

#2 about 3 min

Preventing broken object level authorization in APIs

Hardcoding or guessing resource IDs without mandatory permission checks grants unauthorized access to sensitive user data.

#3 about 6 min

Securing JSON web tokens against broken authentication

Misconfigured token signatures and shared secrets require strict validation and secure backend-for-frontend patterns for single page applications.

#4 about 4 min

Mitigating broken object property level authorization and mass assignment

Unrestricted model binding allows attackers to overwrite restricted object properties like creation dates unless stopped by specific allow lists.

#5 about 4 min

Handling unrestricted resource consumption and query batching

Rate limiting and strict pagination boundaries protect API endpoints from denial of service attacks via overloaded background queries.

#6 about 1 min

Enforcing broken function level authorization across HTTP methods

Failing to secure alternate HTTP methods like POST leaves restricted endpoints vulnerable despite enforcing checks on standard GET requests.

#7 about 2 min

Restricting access to sensitive business flows

Threat modeling and processional countermeasures like canceling duplicate transactions prevent structural abuse of API business logic.

#8 about 3 min

Understanding server side request forgery attacks

Unrestricted intermediate servers can be leveraged to access internal network resources by forwarding forged attacker requests.

#9 about 3 min

Fixing security misconfigurations and revealing HTTP headers

Implementing explicit security headers and removing framework version numbers eliminates obvious exploitation paths for attackers.

#10 about 2 min

Implementing proper API inventory management and sunsetting processes

Documenting forgotten test servers and enforcing strict version retirement processes minimizes the unmaintained attack surface.

#11 about 2 min

Defending against unsafe consumption of third party APIs

Treating external API responses as untrusted user input guarantees resilience against unexpected failures or maliciously injected payloads.

Matching moments

6:11 min

Overview of the 2025 OWASP Top Ten list

Christian Wenz Christian Wenz · World Congress 2026 Europe

12:11 min

Identifying and mitigating top software vulnerability classes

Thomas Konrad · World Congress 2021

3:15 min

The current state of enterprise APIs and security trends

Pratim Bhosale Pratim Bhosale · World Congress 2025

41 sec

Identifying missing security risks beyond the top ten

Christian Wenz Christian Wenz · World Congress 2026 Europe

2:00 min

Key architectural takeaways for building secure APIs

Philippe De Ryck · LIVE

1:08 min

Overview of the OWASP MCP top ten vulnerabilities

Jose Manuel Ortega Jose Manuel Ortega · Europe 2026 Virtual

More from World Congress 2025

GenAI Security: Navigating the Unseen Iceberg thumbnail
24:33
11 months ago

GenAI Security: Navigating the Unseen Iceberg

Maish Saidel-Keesing

Behind the Code: How Women Are Powering the Future of AI thumbnail
30:28
about 1 year ago

Behind the Code: How Women Are Powering the Future of AI

Alexandra Wudel, Laura Moritz, Madalina Florean

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise? thumbnail
28:12
about 1 year ago

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise?

Justus Lumpe, Konstantin Vinogradov, Nils Eiteneyer, Stephan Wirris

AI in Leadership: How Technology is Reshaping Executive Roles thumbnail
28:19
about 1 year ago

AI in Leadership: How Technology is Reshaping Executive Roles

Bernd Datler, Jasmin Kaiser, Jeff Hausmann, Sonja Alvarez

The AI-Ready Stack: Rethinking the Engineering Org of the Future thumbnail
28:09
about 1 year ago

The AI-Ready Stack: Rethinking the Engineering Org of the Future

Alex Laubscher, Jan Oberhauser, Keno Dreßel, Mirko Novakovic

AI Sovereignty: What Does It Take? thumbnail
29:13
about 1 year ago

AI Sovereignty: What Does It Take?

Boris Hecker, Clemens Wasner, Robin Hermann, Sonja Alvarez

Related videos

Bulletproof Web Applications: The 2025 OWASP Top Ten thumbnail
25:29
World Congress 2026 Europe • 3 months ago

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

Architecting API Security thumbnail
47:34
LIVE • over 4 years ago

Architecting API Security

Philippe De Ryck

Lessons learned from observing a billion API requests thumbnail
23:47
World Congress 2025 • about 1 year ago

Lessons learned from observing a billion API requests

Pratim Bhosale

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
World Congress 2023 • about 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

An Opinionated Guide to Bulletproof APIs thumbnail
27:13
World Congress 2026 Europe • 3 months ago

An Opinionated Guide to Bulletproof APIs

Rustam Mehmandarov

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.