API bezbednost: 10 OWASP API Security rizika koje morate znati

← Blog

Zašto je API bezbednost posebna oblast?

API-ji (Application Programming Interfaces) su gradivni blokovi modernog interneta — mobilnih aplikacija, SaaS platformi, IoT uređaja i mikroservisa. Za razliku od web aplikacija gde browser pruža određenu zaštitu, API-ji direktno izlažu poslovnu logiku i podatke. Napadači koji napadaju API-je ne trebaju da obilaze UI kontrole — direktno komuniciraju sa backend sistemom.

OWASP je 2019. objavio API Security Top 10 (ažuriran 2023), prepoznajući da su API ranjivosti fundamentalno različite od web app ranjivosti i zahtevaju posebnu metodologiju testiranja.

OWASP API Security Top 10 (2023)

API1: Broken Object Level Authorization (BOLA)

Ekvivalent IDOR-a za API-je — najčešće pronađena ranjivost. API endpoint prihvata object ID bez provjere da li autentifikovani korisnik ima pravo pristupa tom objektu.

GET /api/v1/invoices/5532  → vraća tuđu fakturu
PUT /api/v1/users/8821/email  → menja tuđi email

API2: Broken Authentication

Loše implementirana autentifikacija: API ključevi u URL-ovima, JWT tokeni bez expirationa, nedostatak brute force zaštite na login endpoint-u, slabi algoritmi za potpisivanje tokena.

API3: Broken Object Property Level Authorization

Endpoint dozvoljava promenu property-ja koji korisnik ne bi trebao da menja. Primer: PUT /api/profile sa body-jem {"email":"...", "role":"admin"} — ako server slepo ažurira sve primljene property-je (mass assignment), napadač postaje admin.

API4: Unrestricted Resource Consumption

API nema rate limiting, nema ograničenja veličine payload-a, nema kvota. Napadač može izvući celu bazu kroz paginaciju, generisati ogromne serverske troškove ili srušiti servis.

API5: Broken Function Level Authorization

Endpoint-i za admin akcije su dostupni regularnim korisnicima: DELETE /api/users/{id} bez provere da li je korisnik admin, POST /api/admin/export dostupno bez admin tokena.

API6: Unrestricted Access to Sensitive Business Flows

API dozvoljava automatizovano zloupotrebljavanje poslovnih tokova: kupovina ograničenih artikala robotima, spam registracija, sistematsko popunjavanje promo kodova.

API7: Server-Side Request Forgery (SSRF)

API prihvata URL koji server sam treba da dohvati. Napadač šalje URL koji cilja interne servise: {"url": "http://169.254.169.254/latest/meta-data/"} — AWS metadata endpoint.

API8: Security Misconfiguration

CORS policy koja dozvoljava bilo koji origin (Access-Control-Allow-Origin: *), verbose error poruke sa stack trace-om, debug endpoint-i u produkciji, zastarele API verzije koje nisu ugašene.

API9: Improper Inventory Management

Organizacija ne zna koje API verzije su aktivne, koje su zastarele, koje su izložene eksternim korisnicima. Zaboravljena stara API verzija bez sigurnosnih zakrpa je česta ulazna tačka.

API10: Unsafe Consumption of APIs

Vaš API konzumira third-party API-je i slepo veruje njihovim odgovorima bez validacije — napadač koji kompromituje third-party servis može injektovati podatke u vašu aplikaciju.

Ključne API bezbednosne prakse

• Autorizacija na svakom endpoint-u: Proveravajte i autentifikaciju I autorizaciju — ko je korisnik i šta sme da radi
• Rate limiting: Nginx limit_req, API Gateway throttling, Redis-bazirani counteri
• Input validacija: Validacija svih ulaznih parametara (tip, format, dužina) pre obrade
• Minimalan response: Vraćajte samo podatke koje klijent treba, ne ceo database objekat
• Versioning strategija: Depricated API verzije ugasite u definisanom roku
• Logging i monitoring: Svaki API poziv mora biti logovan — ko, kada, šta

← Blog

Why Is API Security a Separate Field?

APIs (Application Programming Interfaces) are the building blocks of the modern internet — mobile applications, SaaS platforms, IoT devices, and microservices. Unlike web applications where the browser provides some protection, APIs directly expose business logic and data. Attackers targeting APIs don't need to bypass UI controls — they communicate directly with the backend system.

OWASP published the API Security Top 10 in 2019 (updated in 2023), recognizing that API vulnerabilities are fundamentally different from web app vulnerabilities and require a specialized testing methodology.

OWASP API Security Top 10 (2023)

API1: Broken Object Level Authorization (BOLA)

The API equivalent of IDOR — the most commonly found vulnerability. An API endpoint accepts an object ID without checking whether the authenticated user has the right to access that object.

GET /api/v1/invoices/5532  → returns someone else's invoice
PUT /api/v1/users/8821/email  → changes someone else's email

API2: Broken Authentication

Poorly implemented authentication: API keys in URLs, JWT tokens without expiration, lack of brute force protection on the login endpoint, weak token signing algorithms.

API3: Broken Object Property Level Authorization

An endpoint allows changing properties the user shouldn't be able to change. Example: PUT /api/profile with body {"email":"...", "role":"admin"} — if the server blindly updates all received properties (mass assignment), the attacker becomes an admin.

API4: Unrestricted Resource Consumption

The API has no rate limiting, no payload size restrictions, no quotas. An attacker can extract an entire database through pagination, generate massive server costs, or bring down the service.

API7: Server-Side Request Forgery (SSRF)

The API accepts a URL that the server itself should fetch. An attacker sends a URL targeting internal services: {"url": "http://169.254.169.254/latest/meta-data/"} — the AWS metadata endpoint.

Key API Security Practices

• Authorization on every endpoint: Check both authentication AND authorization — who the user is and what they're allowed to do
• Rate limiting: Nginx limit_req, API Gateway throttling, Redis-based counters
• Input validation: Validate all input parameters (type, format, length) before processing
• Minimal response: Return only the data the client needs, not the entire database object
• Versioning strategy: Decommission deprecated API versions within a defined timeframe
• Logging and monitoring: Every API call must be logged — who, when, what