API Security: OWASP API Top 10, Authentication and Best Practices
API Security guide: OWASP API Top 10 (2023), authentication (API Keys, JWT, OAuth 2.0, mTLS), REST/GraphQL testing, Burp, Postman, jwt_tool.
Summary: Shadow APIs are undocumented, forgotten, or unmanaged API endpoints that run in production without the security team’s knowledge. They arise from legacy systems, rapid development cycles, or shadow IT. Security risks include: no authentication, missing rate limits, and unpatched vulnerabilities. Detection is achieved through API discovery tools, traffic analysis, and API gateways.
Sources & References
- [1] OWASP API Security Top 10 2023 - OWASP Foundation
- [2] OWASP API Security Project - OWASP Foundation
- [3] OWASP Testing Guide v4.2 - OWASP Foundation
- [4] JWT Security Best Practices - Auth0
- [5] OAuth 2.0 Security Best Current Practice - IETF
- [6] GraphQL Security Overview - OWASP Foundation
Questions about this topic?
Our experts advise you free of charge and without obligation.
About the Author
Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.
10 Publikationen
- Einsatz von elektronischer Verschlüsselung - Hemmnisse für die Wirtschaft (2018)
- Kompass IT-Verschlüsselung - Orientierungshilfen für KMU (2018)
- IT Security Day 2025 - Live Hacking: KI in der Cybersicherheit (2025)
- Live Hacking - Credential Stuffing: Finanzrisiken jenseits Ransomware (2025)
- Keynote: Live Hacking Show - Ein Blick in die Welt der Cyberkriminalität (2025)
- Analyse von Angriffsflächen bei Shared-Hosting-Anbietern (2024)
- Gänsehaut garantiert: Die schaurigsten Funde aus dem Leben eines Pentesters (2022)
- IT Security Zertifizierungen - CISSP, T.I.S.P. & Co (Live-Webinar) (2023)
- Sicherheitsforum Online-Banking - Live Hacking (2021)
- Nipster im Netz und das Ende der Kreidezeit (2017)
