API Security Testing

Question

Scenario: Your banking API handles sensitive financial transactions. A security audit reveals several vulnerabilities. You have 3 critical issues to fix: (1) User A can see User B's account balance by changing account_id in request, (2) Passwords are transmitted over HTTP (not HTTPS), (3) API has no rate limiting - attacker can brute force login 10,000 times/second. Prioritize these and explain your fixing approach with testing strategy.

Accepted Answer

PRIORITY RANKING: CRITICAL (Fix immediately - Risk: $$$): Issue 1 - Authorization bypass (User sees other user's balance) & Issue 2 - HTTP vs HTTPS (Password in plain text). HIGH (Fix within 1 week): Issue 3 - No rate limiting (Brute force attacks). DETAILED ANALYSIS & SOLUTIONS: ISSUE 1 - AUTHORIZATION BYPASS (CRITICAL): VULNERABILITY: GET /api/accounts/456/balance returns User B's balance even when requesting as User A. ATTACK SCENARIO: Attacker knows User B's account ID = 456, Requests GET /api/accounts/456/balance with their own auth token, API returns User B's balance without verification, Attacker knows exactly how much money User B has. BUSINESS IMPACT: Massive privacy breach, Regulatory violation (GDPR, PCI-DSS), Customer lawsuits, Bank loses trust. FIX APPROACH: Add authorization check before returning data: def getAccountBalance(accountId): // BUGGY CODE - returns data for ANY account currentUser = getAuthenticatedUser(); account = db.get('accounts', accountId); if account is None: return error(404); return success(account.balance); // BUG: Doesn't check if current user owns account. // FIXED CODE - verify ownership before returning: def getAccountBalance(accountId): curr

Area	Test
Authentication	Can I access API without token or with invalid token?
Authorization	Can I access another user's data by changing user ID?
Input Validation	What happens with SQL injection or special characters?
Data Encryption	Is HTTPS enforced? Are credentials transmitted securely?
Rate Limiting	Can I overload API with rapid requests?

API Security Testing

📌 Definition:

📖 Detailed Explanation:

📎 Security Areas:

🎯 Scenario-Based Interview Question: