Issue 228: 3rd party API security, OAuth2 step-up deep-dive, shadow and zombie APIs
Brief
This week, we have a timely article on the five best practices for ensuring the security of 3rd party APIs, a deep-dive guide into the OAuth2 step-up authentication protocol, and two separate articles on the danger of hidden APIs, namely shadow and zombie APIs. We conclude with not one but two excellent guides from Dana Epp on SSRF and the Gron tool.
Article: Five best practices for 3rd party API security
One of the new entries into the OWASP API Security Top 10 in 2023 is API10:2023 Unsafe Consumption of APIs , which addresses the risks associated with consuming 3rd party APIs. This topic receives surprisingly little coverage, and it was good to see this excellent article in CSO Online covering five best practices to ensure the security of 3rd party APIs.