Tutorial 2: Web and API Security

Unit 5 ยท Application and data security

Objectives

APIs expose business operations to automated clients. Enforce authorization on each object, constrain pagination and payload sizes, rate-limit expensive actions, and avoid revealing whether sensitive accounts exist. Browser security additionally depends on cookies, origin policy, CSRF defenses, and content security policy.

authorize(subject, action, resource)
validate(schema, limits)
execute safely
return stable status + non-sensitive error

API gateways can centralize coarse controls, but domain services must enforce resource-level policy. Errors should help legitimate clients recover without exposing stack traces, database details, or secrets.

Exercises

  1. Write tests for cross-user object access.
  2. Choose limits for page size, body size, and request rate.
  3. Design cookies for a browser session.

Self-check

  1. What is object-level authorization?
  2. Why rate-limit?
  3. Why avoid detailed production errors?

Self-Check Quiz

1. Is an API gateway enough to enforce every permission?

AnswerNo. The service owning the resource must enforce its domain authorization.

2. What does CSRF exploit?

AnswerA browser's automatic credential submission to cause an unwanted state-changing request.

Homework

  1. Design a secure API for document sharing.
  2. Specify authorization, limits, error responses, and session policy.
  3. Write abuse-case tests.
Sample answerEvery document operation checks the authenticated subject and document policy. Requests have bounded body and page sizes, rate limits, consistent errors, secure same-site cookies or tokens, CSRF protection where cookies are used, and tests for cross-tenant access.