OWASP API Security Top 10 (2023)

OWASP API Security Top 10 (2023 Consensus Table)

The OWASP API Security Top 10 2023 is based on a consensus of security experts from around the world. The risks are ranked by exploitability, detectability, and impact. Organizations should use this list to understand the most critical API security risks and take appropriate measures to protect their APIs.

Rank	Vulnerability	Description	Impact
1	Broken Object Level Authorization	APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues.	Critical
2	Broken Authentication	Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens.	Critical
3	Broken Object Property Level Authorization New	Lack of or improper authorization validation at the object property level.	Critical
4	Unrestricted Resource Consumption	Missing or insufficient rate limiting and resource allocation controls.	High
5	Broken Function Level Authorization	Complex access control policies leading to authorization flaws.	High
6	Unrestricted Access to Sensitive Business Flows New	APIs exposing business flows without proper controls against automated abuse.	High
7	Server Side Request Forgery	APIs fetching remote resources without validating user-supplied URIs.	High
8	Security Misconfiguration	Missing or insecure configurations in API infrastructure.	High
9	Improper Inventory Management	Lack of proper API documentation and version management.	High
10	Unsafe Consumption of APIs	Insecure handling of data from third-party APIs.	High

Source: OWASP API Security Project

API1:2023

Broken Object Level Authorization (BOLA)

APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. BOLA occurs when an API endpoint accepts an object ID from client input without validating if the authenticated user owns or has permission to access that specific resource.

// ATTACK SCENARIO: User A (JWT sub: 102) sends request:
GET /api/v1/accounts/103/balance
// Server returns data for User B (ID 103) because it failed to check req.user.id === account.owner_id

// REMEDIATION: Always enforce object-level authorization checks
if (account.owner_id !== req.user.id && !req.user.roles.includes('ADMIN')) {
  return res.status(403).json({ error: 'Access Denied: Object authorization failed' });
}
      

API2:2023

Broken Authentication

Authentication mechanisms in APIs are often implemented incorrectly, allowing attackers to compromise authentication tokens, exploit implementation flaws, or brute-force weak credentials to assume other users' identities.

Remediation: Implement OAuth 2.0 / OpenID Connect with PKCE, enforce short-lived JWT access tokens with secure refresh tokens, and apply exponential backoff rate-limiting on login endpoints.

API3:2023

Broken Object Property Level Authorization (BOPLA)

Replaces Mass Assignment and Excessive Data Exposure. Occurs when an API endpoint allows users to read or mutate properties of an object that they shouldn't have access to (e.g., modifying "is_admin": true in a user update POST request).

// SECURE: Use strict Data Transfer Object (DTO) validation / allow-listing properties
const allowedUpdates = pick(req.body, ['first_name', 'last_name', 'phone']);
await db.user.update(req.user.id, allowedUpdates);
      

API4:2023

Unrestricted Resource Consumption

APIs that do not restrict execution limits (request rates, memory allocation, database query timeouts, or payload sizes) are vulnerable to Denial of Service (DoS) attacks or excessive cloud infrastructure billing charges.

Remediation: Enforce rate limiting via Redis token-bucket middleware, cap maximum JSON payload sizes (e.g., 100KB), enforce strict pagination limits (e.g., limit=50), and configure query execution timeouts.

API5:2023

Broken Function Level Authorization (BFLA)

Flaws where complex access control policies with different hierarchy levels and roles are not properly separated, allowing regular users to invoke administrative API functions (e.g., POST /api/v1/admin/users/delete).

Additional API Top 10 Threats (API6 - API10)

API6:2023 Unrestricted Access to Sensitive Business Flows: Failing to prevent automated bots from abusing business operations like purchasing limited tickets or creating mass accounts.
API7:2023 Server Side Request Forgery (SSRF): Allowing user-controlled URLs to trigger internal HTTP requests to backend microservices or cloud metadata endpoints (169.254.169.254).
API8:2023 Security Misconfiguration: Unhandled exceptions leaking stack traces, unneeded HTTP methods enabled, or permissive CORS wildcard headers (Access-Control-Allow-Origin: *).
API9:2023 Improper Inventory Management: Deprecated API v1 endpoints left online without authentication or documentation drift between OpenAPI specs and production code.
API10:2023 Unsafe Consumption of APIs: Trusting third-party or external vendor APIs blindly without validating their JSON payloads or enforcing timeouts.