API Security Testing — Authentication Bypass, Injection, and Rate Limit Validation

In this tutorial, you will learn about API Security Testing. We cover key concepts, practical examples, and best practices to help you master this topic.

API security testing identifies vulnerabilities like broken authentication, injection flaws, excessive data exposure, and missing rate limiting through automated and manual probing techniques.

What You'll Learn

• How to test for authentication and authorization bypass
• Techniques for detecting injection vulnerabilities
• Validating rate limiting and input sanitization

Why It Matters

APIs are a primary attack vector. A single security flaw can expose sensitive data or allow unauthorized access. Security testing prevents breaches before they reach production.

Real-World Use

A fintech API processes fund transfers. Security tests reveal that the API accepts JWT tokens with alg: none, allowing attackers to forge tokens and transfer funds from any account.

flowchart TD
    A[API Security Scan] --> B[Auth Tests]
    A --> C[Injection Tests]
    A --> D[Rate Limit Tests]
    A --> E[Exposure Tests]
    B --> F[Report Vulnerabilities]
    C --> F
    D --> F
    E --> F

Testing Authentication Bypass

Verify that the API rejects requests without valid authentication.

import requests

url = "https://api.example.com/users/me"

# No auth header
resp1 = requests.get(url)
assert resp1.status_code == 401

# Invalid token
resp2 = requests.get(url, headers={"Authorization": "Bearer invalid"})
assert resp2.status_code == 401

# Expired token
expired = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjB9."
resp3 = requests.get(url, headers={"Authorization": f"Bearer {expired}"})
assert resp3.status_code == 401

print("Auth tests passed")

Expected output: Auth tests passed

Testing SQL Injection

Send malicious input to see if the API is vulnerable to injection.

payloads = [
    "' OR '1'='1",
    "'; DROP TABLE users; --",
    "1 UNION SELECT * FROM users",
    "\" OR 1=1 --",
]

for payload in payloads:
    resp = requests.get(f"https://api.example.com/users?id={payload}")
    # If the API returns user data for injection payloads, it's vulnerable
    if resp.status_code == 200 and len(resp.json()) > 0:
        print(f"Vulnerable to: {payload}")
    else:
        print(f"Blocked: {payload}")

Expected output: All payloads should be blocked. If any returns user data, the API is vulnerable.

Testing Rate Limiting

Verify that the API enforces rate limits by sending rapid requests.

url = "https://api.example.com/products"
responses = []
for i in range(100):
    resp = requests.get(url)
    responses.append(resp.status_code)
    if resp.status_code == 429:
        print(f"Rate limited after {i+1} requests")
        break

assert 429 in responses

Expected output: Rate limited after N requests where N is the rate limit threshold.

Common Mistakes

Practice Questions

1. What is IDOR? A: Insecure Direct Object Reference — accessing resources by changing IDs in requests.
2. How do you test for JWT tampering? A: Change the algorithm to none, modify the payload, or use a weak secret.
3. What status code indicates rate limiting? A: 429 Too Many Requests.
4. What is mass assignment? A: When an API accepts extra fields in the request body, allowing users to modify unauthorized properties.
5. How does OWASP ZAP help with API security testing? A: It automatically crawls endpoints and runs passive and active scanning for vulnerabilities.

Challenge

Write a security test suite that: sends an IDOR request to access another user's profile, tests JWT algorithm confusion with alg: none, attempts SQL injection on the login endpoint, verifies rate limiting after 60 requests per minute, and checks that OPTIONS requests don't expose sensitive headers.

FAQ

What is the OWASP API Security Top 10?

A list of the most critical API security risks, including broken auth, excessive data exposure, and injection.

How do you test for NoSQL injection?

Send special operators like $ne, $gt, or $regex in JSON request bodies to see if they bypass authentication.

What is a JWT algorithm confusion attack?

When the server accepts a token signed with the none algorithm or uses the public key as an HMAC secret.

How do you test CORS Misconfiguration?

Send requests with Origin: https://evil.com and check if the response includes Access-Control-Allow-Origin: *.

What tools automate API security testing?

OWASP ZAP, Burp Suite, Postman with security collections, and custom scripts with Python requests.

How do you test for excessive data exposure?

Compare the response with and without authorization to see if the API returns the same rich data.

What is a rate limiting bypass?

Using multiple IP addresses, changing headers, or rotating tokens to exceed the rate limit.

Mini Project

Build an API security test suite for a user management API. Test: unauthenticated access returns 401, JWT with alg: none is rejected, SQL injection payloads are blocked, IDOR attempts on other users' profiles fail, PATCH requests only update allowed fields, and rate limiting kicks in after 100 requests per minute.

What's Next

After security testing, learn Contract Testing with Pact to ensure API consumers and providers agree on the interface.