API API Authentication and Security 3

Question 1

What does 'Broken Object Level Authorization' (BOLA) mean in API security?

Accepted Answer

A user accessing objects they don't own by manipulating IDs

Answer

BOLA (also called IDOR) occurs when an API doesn't verify whether a user is authorized to access a specific object, allowing ID manipulation attacks.

Question 2

Which HTTP response header helps prevent clickjacking attacks on API-served content?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options prevents the page from being embedded in iframes, protecting against clickjacking attacks.

Question 3

What is an API security token expiry time best practice?

Accepted Answer

Use short expiry with refresh tokens

Answer

Short-lived access tokens combined with refresh tokens reduce the window of opportunity if a token is compromised.

Question 4

What does 'mass assignment' vulnerability in APIs involve?

Accepted Answer

Binding user input directly to internal object properties without filtering

Answer

Mass assignment occurs when an API binds client-provided data directly to object properties, allowing attackers to set privileged fields.

Question 5

Which security practice involves validating that API inputs match expected formats and ranges?

Accepted Answer

Input validation

Answer

Input validation ensures API inputs conform to expected formats, types, and ranges, preventing injection and other attacks.

API - Testing Practice Test