API Security Best Practices: OWASP API Top 10 in Practice
A developer builds an endpoint that returns a customer’s order. It checks the session token, loads the order by the id in the URL, and returns it. Every test passes, code review approves it, and the API ships.
Nothing in that flow asks whether the order belongs to the caller. Change one digit in the id and the endpoint hands over someone else’s record, because it was never told not to.
That single missing comparison is API1 in the OWASP API Security Top 10, and it remains the most common way real APIs leak data. It also shows why API security best practices read differently from web application ones.
The vulnerability is not a payload, an encoding bug, or a missing header. It is a business rule nobody wrote down.