The API flaws a PM should know how to spot
The most common flaws in an integration can often be seen as early as the spec. This lesson teaches you to recognize the major risks listed in OWASP's API Security Top 10 in a concrete integration and to turn them into security criteria the team can verify.
Lesson objective
By the end of this lesson, you will be able to spot in an integration the most frequent risks of the OWASP API Security Top 10 (access to someone else's object, excess data exposed, unrestricted consumption, blind trust in a third-party API) and write the matching security criteria in the spec.
Topics covered
- API security
- OWASP API Security Top 10
- access control
- security criteria
In the glossary
Where it fits
Authentication, permissions and security
Who may call the API, to do what, and how do you avoid the most common flaws?
Lessons in this module
- API keys, tokens and OAuth 2.0, choosing and specifying
- The API flaws a PM should know how to spot (this lesson)
What you will learn in this module
This lesson is part of the course Design and test an API integration as a PM
- Choose and specify the authentication method (API key, token, OAuth 2.0), the minimal permissions and the rules for managing secrets.
Related courses
- Product ManagementAdvancedRegular practice: you already use the tools or work on this topic.
Git for PMs: ship as a team without putting production at risk
3 hr 30 min
- Tech for PMsAll levelsNo prerequisites: accessible to everyone.
Explain how a web product works, from browser to server
2 hr 30 min
- Tech for PMsJuniorSome basics are useful: introductory knowledge of the topic.
Model your product’s data and query it with SQL
3 hr 30 min