API Security
Authentication, object-level authorization, rate limits, replay, webhooks, mass assignment and file uploads — the boundary most systems actually expose.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Every API operation must parse, validate, authenticate, authorize, limit and record—especially when a request names a resource.
Validation answers “is this value well-formed and meaningful?”; authorization separately answers “may this principal perform this action?”
Binding an arbitrary request object onto a model lets the caller edit fields the UI never exposed, including roles, owners and prices.
Rate limits make guessing and resource abuse more expensive, but they are not authentication and can be distributed around.
A valid request can still be harmful when captured and repeated; authenticity does not automatically imply freshness or exactly-once effect.
A public webhook endpoint must verify who sent the exact body, when it was sent, and whether the event was already processed.
A file crosses several boundaries—request, parser, storage, scanner, processor and serving path—and each interprets different metadata.