Getting API Security Right - Philippe De Ryck - NDC Security 2022

The shift towards an API landscape indicates a significant evolution in the way we build applications. The rise of JavaScript and mobile applications have sparked an explosion of easily-accessible REST APIs. But does the rise of APIs result in the downfall of security? Why are there so many vulnerabilities and incidents involving APIs? How can you ensure that your APIs are secure?
In this session, we use real-world cases to dive into best practices for securing your APIs. We discuss the attack surface of an API, common authorization problems, and best practice techniques to avoid these problems. At the end of this session, you will have an actionable set of guidelines to assess and improve the security of your own APIs.
Check out more of our featured speakers and talks at
ndcconferences.com/
ndc-security.com/

[@richardfrimpong5891]

Now that is a really really good talk.
Thanks a lot Philippe De Ryck

[@sCr33nSh0o71]

what if you have endpoint user/tasks/{id} and you dont put validation if you have access to this task but when you make call to the db you use the filter task = id and userid = token.userid ?

[@danfroal8057]

too late better than never ; you waste a call to the database (sometimes costly, and it can stack up), you break single responsibility principle (data layer is not responsible for auth), you make testing, auditing and maintenance difficult (change of schema? distributed databases?). There must be even nastier and more obvious things I don't see from a security standpoint, but these reasons are already enough in terms of best practices.