Today I audited an API that had about as much security as a pasta strainer. The client insisted "everything's fine, we use JWT". Yeah... about that.
What I Found:- An /admin/create-user endpoint with zero authentication (yes, really)
- IDOR vulnerability in /api/user/{id}/profile — substitute any ID to access private profiles
- Rate limiting? What's that? (brute force attacks welcome)
The kicker? This was in production. In 2024. After multiple OWASP API Top 10 publications."But we have NGINX in front!" — the most common (and useless) defenseNewsflash: NGINX isn't a magic wand. Patch your routers before you're explaining to clients why their user database is now on a Russian hacker forum.
- An /admin/create-user endpoint with zero authentication (yes, really)
- IDOR vulnerability in /api/user/{id}/profile — substitute any ID to access private profiles
- Rate limiting? What's that? (brute force attacks welcome)
The kicker? This was in production. In 2024. After multiple OWASP API Top 10 publications.
"But we have NGINX in front!" — the most common (and useless) defense
Newsflash: NGINX isn't a magic wand. Patch your routers before you're explaining to clients why their user database is now on a Russian hacker forum.