Understanding the Evolution of OWASP API Security Top 10 from 2019 to 2023

The Open Web Application Security Project (OWASP) is a non-profit organization dedicated to improving software security. One of their most well-known projects is the OWASP API Security Project, which aims to provide a foundational set of security controls for APIs. In this post, we’ll explore the changes introduced in the 2023 version compared to the 2019 version of the OWASP API Security Top 10.

Key Takeaways

The 2023 version of the OWASP API Security Top 10 introduces new categories that reflect the evolving landscape of API security threats. It emphasizes the importance of proper authorization at both the object and function levels, managing resource consumption, protecting sensitive business flows, and maintaining a proper inventory of APIs. It also introduces the concept of unsafe consumption of third-party APIs, highlighting the risks of trusting data from external sources.

OWASP API Top 10 2023

The 2023 version of the OWASP API Security Top 10 introduces several new categories and redefines existing ones. Here’s a sneak peek:

1. API1:2023 – Broken Object Level Authorization: This category remains the same as in the 2019 version, emphasizing the importance of proper authorization checks for every function that accesses a data source using an ID from the user.
2. API2:2023 – Broken Authentication: This category also remains unchanged, highlighting the risks of incorrectly implemented authentication mechanisms.
3. API3:2023 – Broken Object Property Level Authorization: This new category combines API3:2019 (Excessive Data Exposure) and API6:2019 (Mass Assignment), focusing on the root cause: the lack of or improper authorization validation at the object property level.
4. API4:2023 – Unrestricted Resource Consumption: This category emphasizes the importance of managing the resources required to satisfy API requests, such as network bandwidth, CPU, memory, and storage.
5. API5:2023 – Broken Function Level Authorization: This category highlights the risks associated with complex access control policies and unclear separation between administrative and regular functions.
6. API6:2023 – Unrestricted Access to Sensitive Business Flows: This new category focuses on the risks of exposing business flows without considering how the functionality could harm the business if used excessively in an automated manner.
7. API7:2023 – Server Side Request Forgery: This category highlights the risks of Server-Side Request Forgery (SSRF) flaws, which can occur when an API fetches a remote resource without validating the user-supplied URI.
8. API8:2023 – Security Misconfiguration: This category remains the same as in the 2019 version, emphasizing the risks of missing or incorrect security configurations.
9. API9:2023 – Improper Inventory Management: This new category highlights the importance of maintaining a proper inventory of hosts and deployed API versions to mitigate issues such as deprecated API versions and exposed debug endpoints.
10. API10:2023 – Unsafe Consumption of APIs: This new category focuses on the risks associated with trusting data received from third-party APIs more than user input, leading to weaker security standards.

The Implications of OWASP API Security 2023 Changes

The OWASP API Top 10 2023 version reflects the evolving landscape of API security threats and the growing importance of APIs in today’s digital world. The changes introduced have significant implications for developers, security professionals, and businesses alike.

Emphasis on Authorization

The 2023 version introduces a new category, Broken Object Property Level Authorization, which combines two categories from the 2019 version: Excessive Data Exposure and Mass Assignment. This change emphasizes the importance of proper authorization at the object property level, not just at the object level. It indicates that APIs need to be designed with granular access controls in mind, ensuring that only authorized users can access or modify specific properties of an object.

Resource Management

The addition of Unrestricted Resource Consumption as a category highlights the importance of managing the resources required to satisfy API requests. This is particularly relevant in the era of cloud computing, where resources are billed per usage. Unrestricted resource consumption can lead to increased operational costs and even Denial of Service (DoS) if not properly managed.

Business Logic Protection

The new category Unrestricted Access to Sensitive Business Flows emphasizes the need to protect business logic from abuse. APIs often expose business processes that, if used excessively or in an automated manner, could harm the business. This category encourages businesses to consider the business logic implications of their APIs and implement appropriate rate limiting and abuse prevention mechanisms.

Inventory Management

The addition of Improper Inventory Management as a category highlights the importance of maintaining a proper inventory of hosts and deployed API versions. As microservices architectures and API-first approaches become more prevalent, keeping track of all deployed APIs becomes a significant challenge. This category emphasizes the need for proper API governance and lifecycle management.

Third-Party API Consumption

The new category Unsafe Consumption of APIs highlights the risks associated with trusting data received from third-party APIs. Developers often trust third-party APIs as they would internal APIs, leading to weaker security controls. This category encourages developers to treat third-party API data with the same level of scrutiny as user input.

Conclusion

The changes in the OWASP API Top 10 2023 version underscore the evolving nature of API security threats. They highlight the need for robust authorization controls, resource management, proper inventory management, and safe third-party API consumption. As APIs continue to play a crucial role in modern applications, understanding and mitigating these risks will be key to maintaining secure systems.

Get an Attacker’s View into Your Organization