Implementation vulnerabilities

In the final portion of this chapter, we will cover the remaining vulnerabilities without going into a deep level of detail. Many of these vulnerabilities are not specific to APIs but affect many software systems, and there is already a body of knowledge in the industry on how to address these issues. I have included a Further reading section at the end of this chapter, and as always, the reader is well advised to consult the OWASP project, which maintains excellent guides and resources on these topics.

Injection

Injection vulnerabilities have plagued software systems for over two decades already; fortunately, it is a vulnerability class that can be totally eliminated by implementing patterns for secure coding. Injection attacks occur when a system trusts user input without validating it, allowing an attacker to launch attacks against underlying components such as databases, operating systems, and filesystems. Typical examples include SQL injection...