API Security

3 guides tagged “API Security”.

  1. What Is Broken Access Control (IDOR)? IDOR lets users access other people's data by changing an ID in a request when the app never checks ownership. Learn how it works and how to fix it. Information Security beginner 7 min
  2. JWT Security: Common Mistakes That Get Tokens Stolen JWTs are easy to generate and easy to get wrong. Learn the mistakes — algorithm confusion, weak secrets, no expiry — that turn tokens into access. Information Security intermediate 5 min
  3. How to Test Your App for Broken Access Control A practical guide to testing for IDOR and privilege escalation: two accounts, cross-account ID swaps, and role checks. No security background required. Information Security beginner 8 min