OWASP API Top 10 · 2023 edition

OWASP API Top 10 Challenges

Map your API security training to the OWASP API Security Top 10 (2023). Developers fix BOLA, broken authentication, SSRF and more in real APIs — the same flaws behind the breaches that make headlines.

Book a Demo Explore the Mapping

Capability, not checkbox compliance

Hands-On Challenges for Every Category

APIs are the largest attack surface in modern products, and the OWASP API Security Top 10 (2023) is the standard for securing them. Every challenge below is a real API with a real vulnerability: developers fix it without breaking functionality, and every verified fix becomes reportable evidence of API security capability.

API1:2023

Broken Object Level Authorization

APIs that expose object IDs without checking the caller is allowed to access that object — the most common API attack.

easy

BOLA.api

An endpoint hands out any user’s records if you guess the ID. Add object-level authorization checks so users can only reach their own data.

API2:2023

Broken Authentication

Flawed token, password and session mechanisms that let attackers take over accounts.

easy

JWT2.js

A JSON Web Token implementation accepts tokens it should reject. Repair the verification so forged tokens fail.

easy

BasicAuth.go

A Basic Authentication check compares credentials insecurely. Fix it to resist bypass and timing attacks.

easy

Weekend League.go

A gaming API’s login logic contains an authentication flaw. Find it and fix it without breaking legitimate players.

medium

Broken Auth.api

The API’s authentication flow can be bypassed entirely. Fix how identities are verified before any request is trusted.

medium

Speedy Gonzales.go

Authentication that can be brute-forced at speed. Slow attackers down and harden the credential check.

API3:2023

Broken Object Property Level Authorization

Excessive data exposure and mass assignment: APIs that return or accept object properties the caller should never touch.

easy

Leak.api

An endpoint returns far more fields than the client needs, leaking sensitive properties. Trim the response to what callers are authorized to see.

easy

Mass Assignment.api

The API binds request bodies straight onto internal objects, letting callers set fields like role or balance. Whitelist what can be assigned.

API4:2023

Unrestricted Resource Consumption

Missing rate limits and quotas that let attackers exhaust CPU, memory, bandwidth or your bill.

easy

DoS.api

A single expensive request can grind this API to a halt. Add limits so resource use stays bounded.

easy

Evil API.api

An endpoint invites abuse with unbounded operations. Constrain it before someone runs up the bill.

medium

DoS GraphQL.ts

Deeply nested GraphQL queries explode server resource use. Bound query depth and cost.

API5:2023

Broken Function Level Authorization

Admin and privileged endpoints reachable by regular users because function-level checks are missing.

easy

BFLA.api

Administrative functions are exposed to any authenticated caller. Enforce function-level authorization on privileged endpoints.

API6:2023

Unrestricted Access to Sensitive Business Flows

Legitimate business flows — purchasing, booking, posting — abused at scale because nothing limits automated access.

easy

Bad Business.api

A business-critical flow can be scripted and abused at scale. Protect it without blocking legitimate customers.

API7:2023

Server Side Request Forgery

APIs that fetch attacker-supplied URLs, letting requests reach internal services and cloud metadata.

easy

SSRF.api

The API fetches whatever URL it’s given, reaching internal services. Validate and constrain outbound requests.

API8:2023

Security Misconfiguration

Unhardened API infrastructure: verbose errors, permissive CORS, debug endpoints and discovery features left on.

trivial

Introspection GraphQL.ts

GraphQL introspection is enabled in production, handing attackers your full schema. Turn off what they shouldn’t see.

Roll it out

Turn the Standard Into a Training Program

Assign these challenges to your team as learning pathways, track verified fixes, and report OWASP API Top 10 coverage to auditors, customers and the board — with evidence, not attendance sheets.

Book a Demo Browse all API challenges