TL;DR
API vulnerabilities top the OWASP list for good reason — APIs expose your data model directly. This checklist covers the ten categories that account for the majority of exploitable API findings: JWT attacks, IDOR/BOLA, mass assignment, injection, rate limiting, CORS, and GraphQL-specific vectors.
JWT alg:none remains exploitable in unpatched libraries. Always enforce algorithm allowlisting server-side — never trust the alg header from the client.
RS256 or HS256 only — never none)exp claim) is validated; tokens are not accepted indefinitelystate parameter to prevent CSRFredirect_uri is validated against a strict allowlist (no open redirect)IDOR is the most common critical API finding. If your endpoint accepts an ID parameter and returns data, it must verify that the caller owns that resource — every time, at every layer.
$where, $regex), ElasticSearch (_search), and Redis EVALexec, spawn, system)FEATURE_SECURE_PROCESSING)Mass assignment is frequently introduced silently when new fields are added to a model. An allowlist of accepted fields should be enforced at the deserialization layer, not just the database layer.
role, is_admin, credits must not be settable by clients)role, verified, balance, permissions) are never updated from client-supplied JSONAccess-Control-Allow-Origin is not set to * for endpoints that use cookies or authorization headersnull, not wildcard with credentials enabled)