A practical journey through API security, authorization, JWT, rate limiting, and common vulnerabilities.
Why this is a strong Medium story
Instead of writing a boring article titled "What is API Security?", make it a story:
I thought my REST API was secure because it had JWT authentication. Then I started testing what would happen if a user changed an ID in the URL.
That immediately creates curiosity.
OWASP's API Security Top 10 specifically highlights risks such as Broken Object Level Authorization, Broken Authentication, Broken Function Level Authorization, unrestricted resource consumption, SSRF, security misconfiguration, and improper inventory management.
Story structure
- Authentication isn't authorization
Imagine:
GET /api/incidents/1001
Authorization: Bearer
The token is valid.
But what if user A can request:
GET /api/incidents/1002
and incident 1002 belongs to user B?
The API authenticated the user.
But it didn't authorize access to the object.
That's the difference between:
Authentication
"Who are you?"
Authorization
"What are you allowed to access?"
- JWT doesn't automatically make an API secure
A typical flow:
Login
↓
Username + Password
↓
Spring Security
↓
JWT generated
↓
Client stores token
↓
API request
↓
JWT validation
↓
Authorization
But JWT validation alone doesn't solve:
privilege escalation
broken access control
insecure endpoints
excessive data exposure
rate abuse
- Secure the endpoint
For example:
@PreAuthorize("hasRole('ADMIN')")
@GetMapping("/admin/incidents")
public List getAllIncidents() {
return incidentService.findAll();
}
But method-level security is only one layer.
Your service should also verify ownership where appropriate.
- Never trust IDs from the client
This is dangerous:
incidentRepository.findById(id);
without checking whether the current user has permission to access it.
A better conceptual approach:
Request
↓
Authenticate
↓
Extract user
↓
Load resource
↓
Check ownership / permission
↓
Return resource
- Rate limiting
An endpoint such as:
POST /api/login
can become a target for brute-force attempts.
A production API should consider:
Request
↓
Rate Limiter
↓
Authentication
↓
Authorization
↓
Business Logic
- Security checklist
Before calling an API production-ready, check:
Authentication
Authorization
Input validation
Rate limiting
Secure headers
Error handling
Logging
Secret management
Dependency scanning
HTTPS
API documentation
Access control
OWASP maintains the API Security project specifically to help developers and security teams identify and mitigate these API-specific risks.
Ending
The biggest lesson wasn't how to implement JWT.
It was understanding that security isn't a feature you add to an API. Security is a property of the entire API design.
Tags:
Top comments (0)