The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protect a public API with layered controls across design, deployment, runtime, and ongoing operations—not with a gateway or authentication method alone. Inventory every endpoint, authenticate callers appropriately, authorize each requested object and action on the server, limit resource use and abuse-prone workflows, validate integrations, and continuously test and monitor the service.
What does API security need to protect?
A public API accepts requests from callers you do not fully control. “Public” describes who can reach the service; it does not mean every route should be anonymous, every operation should be available to every authenticated caller, or every request should be treated as safe.
Security therefore has to cover more than identity. It must protect data, individual properties, privileged functions, service capacity, business processes, deployment configuration, and the systems the API calls. NIST SP 800-228, Guidelines for API Protection for Cloud-Native Systems, frames this as work before runtime and during runtime. NIST’s publication page says the guidance was published in June 2025 and includes updates through March 13, 2026. It recommends selecting basic and advanced protections incrementally according to risk, rather than assuming one control fits every API.
OWASP’s API Security Top 10 (2023) is a useful awareness checklist, not a complete threat model or a statistically measured frequency ranking. Its ten risks are:
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
| OWASP API Security Top 10 (2023) risk | Security question to ask |
|---|---|
| Broken object-level authorization | Can a caller access another user’s record by changing an identifier? |
| Broken authentication | Can an attacker impersonate a caller, misuse credentials, or exploit weaknesses in identity checks? |
| Broken object-property-level authorization | Can a caller read or change fields they should not control? |
| Unrestricted resource consumption | Can requests consume excessive compute, storage, bandwidth, or downstream capacity? |
| Broken function-level authorization | Can a caller invoke an administrative or otherwise privileged operation? |
| Unrestricted access to sensitive business flows | Can automation abuse a consequential workflow such as account recovery or purchasing? |
| Server-side request forgery | Can caller-controlled input make the server fetch an unintended destination? |
| Security misconfiguration | Are deployment settings, interfaces, or defaults exposing unnecessary risk? |
| Improper inventory management | Are forgotten, undocumented, debug, or obsolete API surfaces still reachable? |
| Unsafe consumption of APIs | Does the service trust data or behavior from an external API without appropriate safeguards? |
How do you establish the API’s attack surface?
Start with an inventory that reflects what is actually deployed, not just what appears in current documentation. For each API host, route, and version, record its owner, purpose, data classification, authentication expectations, dependencies, and operational status. Include partner, mobile, internal, and administrative interfaces where they exist: an endpoint can be reachable from the public internet even if it was intended for a limited client.
- Reconcile documented routes with deployed services and observed traffic where feasible.
- Identify undocumented routes, debug behavior, old versions, and management interfaces; remove them or restrict access if they are not needed.
- Track who owns each endpoint and dependency so security changes and incident response have a responsible contact.
- Keep the inventory with deployment or infrastructure definitions where practical, and update it as part of release work.
OWASP identifies improper inventory management as an API-specific risk because an organization can expose more API endpoints than it realizes. An inventory is useful only if it stays aligned with deployed reality.
How should callers authenticate?
Choose an authentication mechanism that matches the client and the sensitivity of its operations. Authenticate users or services as appropriate, protect credentials and tokens in transit and storage, and rotate credentials when they are compromised. An API key can identify an application or support usage controls, but it is not proof of a human identity and should not by itself authorize sensitive actions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →For OAuth 2.0, use current protocol guidance rather than copying an old flow diagram. OWASP’s OAuth 2.0 Protocol Cheat Sheet recommends Proof Key for Code Exchange (PKCE) for public clients using the authorization code flow. PKCE helps address authorization-code interception; it does not, by itself, protect an issued access token. Bearer tokens can be used by whoever possesses them, so consider measures that bind a token to its intended client when the threat model calls for stronger protection.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Authentication answers “who or what is calling?” It does not answer whether that caller may perform the requested operation on the requested data.
How do you prevent authorization failures?
Enforce authorization on the server at the point where the requested data or action is accessed. For every request, determine whether this principal may access this particular object, read or change these particular properties, and invoke this particular function. Do not rely on a client interface hiding buttons or fields: a caller can construct requests directly.
- Check object ownership or other access policy whenever a request uses a record identifier; do not assume that an authenticated caller is entitled to every valid identifier.
- Allowlist fields a caller may write instead of binding arbitrary request properties into internal models. Apply equivalent checks to fields returned in responses.
- Restrict privileged and administrative functions by role and context, and deny by default when a request lacks an explicit authorization decision.
- Keep decisions server-side and test with multiple users and roles, including attempts to substitute identifiers, modify protected fields, and call privileged routes.
OWASP lists object-level, object-property-level, and function-level authorization failures separately because passing one access check does not guarantee the other two are correct. A user may be permitted to view an object but not alter its ownership field or use an administrative operation.
How do you limit resource use and workflow abuse?
Set limits according to what an operation costs and what abuse would do—not only how many requests arrive. Bound payload sizes, pagination, query complexity, concurrency, expensive operations, and downstream work. Apply quotas or throttles in a way that accounts for caller identity, operation, and expected usage.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Also protect sensitive business flows. A request rate that is ordinary for reading public information may be harmful when used to send paid messages, submit purchases, or repeatedly trigger account recovery. Use controls suited to the consequence of the workflow, such as eligibility checks, friction, limits, or additional verification where appropriate. OWASP treats unrestricted resource consumption and unrestricted access to sensitive business flows as distinct risks. There is no universal requests-per-second threshold: a reasonable limit depends on capacity, service cost, expected user behavior, and the impact of abuse.
How should you handle configuration and server-side URL fetching?
Use secure defaults and review configuration at both the API gateway and the origin service. Restrict management interfaces, remove debug behavior, and review CORS, TLS, error handling, security headers, and gateway-to-origin settings. A perimeter rule cannot correct an unsafe authorization decision inside the application.
If a caller can cause the server to fetch a URL, treat that input as a possible route into networks the caller cannot reach directly. Validate destinations against an allowlist appropriate to the feature and prevent access to internal or otherwise unintended networks. OWASP identifies both security misconfiguration and server-side request forgery as API risks.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow do you make third-party API integrations safer?
Treat every response from an external service as input, even when the provider is familiar and the connection uses TLS. Validate and sanitize returned data before storing it or using it in another operation. Constrain redirects to known destinations, and set timeouts and resource limits so a slow, unexpectedly large, or malicious response cannot consume unbounded resources.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
These precautions address unsafe consumption of APIs: a compromised or hostile integration response can become an injection, data exposure, or denial-of-service path in your own service. OWASP’s API10:2023 guidance also says to assess a service provider’s API security posture when evaluating providers.
What should you log, test, and monitor?
Log security-relevant events that can help detect and investigate misuse: authorization failures, unusual access patterns, token failures, configuration changes, high-cost operations, and unexpected endpoint use. Avoid putting secrets or unnecessary sensitive data in logs. Alert on patterns that may indicate enumeration, abuse, or access to routes absent from the expected inventory.
Test authorization boundaries and abuse cases during development and deployment, not only whether valid requests succeed. Include attempts to cross user boundaries, change protected fields, invoke restricted functions, exceed resource limits, and misuse consequential workflows. Feed incidents, newly discovered routes, and changes in dependencies back into the API inventory and threat model. This makes security an ongoing runtime responsibility as well as a pre-release activity, consistent with NIST SP 800-228’s lifecycle framing.
How should you choose API protection controls?
Different enforcement points solve different problems. A gateway or cloud edge can help apply perimeter policies and traffic controls; application code is often where object- and function-level authorization decisions can be made with the necessary business context. Discovery, testing, runtime enforcement, and observability may therefore require a combination of controls.
- Coverage: Check whether the approach supports endpoint discovery, authorization testing, runtime traffic enforcement, abuse controls, and observability.
- Deployment fit: Identify where the API’s actual enforcement point sits—gateway, cloud edge, service mesh, application library, or a combination—and account for any routes that bypass it.
- Control depth: Determine whether it can enforce object- and function-level authorization or mainly identify traffic and apply perimeter rules.
- Operational ownership: Account for integration effort, false positives, latency, telemetry, staffing, and the ongoing work of maintaining policies.
- Evidence and fit: Verify documented capabilities and test them against your own API threat model and infrastructure rather than relying on a general claim of protection.
OWASP’s 2023 API Top 10 should inform that threat model, but it is an awareness document rather than a guarantee that its list contains every relevant risk. OWASP’s methodology page states that its public call for data did not produce data enabling a relevant statistical analysis of the most common API security issues. The Top 10 should not be read as a measured ranking of how frequently those issues occur.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
