API Security for the Impatient Developer

An order ID goes up by one in a URL and a stranger's data appears, because nobody checked whether the caller was allowed to see it. Most real API breaches come from a short list of ordinary mistakes like this one: a token decoded but never verified, a request body copied straight onto a database record, a login endpoint with no limit on attempts, one all-powerful key in a config file. This book pa...