Skip to main content

REST API Security & OWASP Top 10 Checklist

A practical, interactive security verification checklist for QA and SDETs to audit backend endpoints against the OWASP API Security Top 10 guidelines.

Use this tool to track your security audits; progress is saved automatically in your browser's local storage.

Checklist Completion

Track your testing preparations live. Your progress is saved automatically.

0 of 14 items completed0% Done
🔑1. Authentication & Session Security (API1 / API2)
0/3
JWT tokens use short expiration & strong signing algorithms.
Example: Access tokens expire in 15 mins; verified that `alg: none` or weak HMAC-SHA256 secrets are rejected.
Broken Object Property & Function Level Authorization tested.
Example: Regular user attempting to call admin routes (e.g. `POST /api/v1/admin/users`) receives `403 Forbidden`.
BOLA / IDOR vulnerability checks executed.
Example: Changing URL parameter `/api/orders/1024` to another user's ID `/api/orders/1025` returns `403 Forbidden`.
🛡️2. Input Validation & Data Sanitation (API3 / API8)
0/3
SQL / NoSQL injection payloads rejected.
Example: Sending `' OR 1=1 --` or `{"$ne": null}` in query parameters is sanitized and returns `400 Bad Request`.
Mass assignment / parameter tampering prevented.
Example: Sending unexpected JSON keys like `{"isAdmin": true, "balance": 9999}` in registration payload is ignored/rejected.
Cross-Site Scripting (XSS) payload escaping confirmed.
Example: HTML/JS characters in input fields are sanitized; `Content-Type: application/json` strictly enforced.
⏱️3. Rate Limiting & Resource Consumption (API4)
0/3
API rate limiting / throttling active on sensitive endpoints.
Example: Login or OTP endpoints enforce max 5 requests/min, returning `429 Too Many Requests` with `Retry-After` header.
Maximum payload size limit enforced (DoS prevention).
Example: Uploading JSON requests > 2MB or large multipart files returns `413 Payload Too Large`.
Pagination limits enforced on list endpoints.
Example: `GET /api/v1/items?limit=100000` is capped to a maximum allowable page size (e.g., max 100).
👁️4. Information Disclosure & Security Headers (API7 / API9)
0/3
Stack traces & server versions hidden in error responses.
Example: On 500 errors, response returns sanitized JSON `{ "error": "Internal Server Error", "code": "ERR_500" }` without DB traces.
Security headers configured properly.
Example: `X-Content-Type-Options: nosniff`, `Strict-Transport-Security (HSTS)`, `X-Frame-Options: DENY` present in all responses.
CORS policy explicitly configured (no wildcard with credentials).
Example: `Access-Control-Allow-Origin` set only to trusted whitelisted domains; `*` wildcard rejected when credentials are true.
🔒5. Transport & Data Encryption
0/2
HTTPS mandatory with HTTP redirection disabled for APIs.
Example: Plain HTTP requests to `http://api.domain.com` immediately return `301 Moved Permanently` to HTTPS.
No PII or secrets printed to server/gateway logs.
Example: Passwords, credit card numbers, and auth bearer tokens masked as `***` in Datadog/Splunk logs.

OWASP API Risk Architecture​