API API Authentication & Security Testing 3

Question 1

What does OAuth 2.0 authorization code flow primarily protect against compared to the implicit flow?

Accepted Answer

Exposing access tokens in the browser URL

Answer

The authorization code flow exchanges a short-lived code server-side for tokens, preventing access tokens from appearing in browser history or logs.

Question 2

Which OWASP API Security risk occurs when an API returns more data than the client needs?

Accepted Answer

Excessive Data Exposure

Answer

Excessive Data Exposure happens when an API returns full object data, relying on the client to filter, which risks leaking sensitive fields.

Question 3

What is the recommended way to store API keys in client-side applications?

Accepted Answer

Store them in environment variables or a secrets manager, never in frontend code

Answer

API keys must never be exposed in client-side code; they should be kept in server-side environment variables or a secrets manager.

Question 4

What does the term 'mass assignment' vulnerability mean in API security?

Accepted Answer

An API blindly binding user-supplied fields to internal object properties

Answer

Mass assignment occurs when an API maps all client-provided fields to a model without filtering, letting attackers set privileged fields like 'isAdmin'.

Question 5

Which tool is commonly used for API security scanning and vulnerability detection?

Accepted Answer

OWASP ZAP

Answer

OWASP ZAP (Zed Attack Proxy) is an open-source security scanner that can intercept, analyze, and attack API endpoints to find vulnerabilities.

API - Testing Practice Test

API - Testing Practice Test

API API Authentication & Security Testing 3