API Security Misconfiguration

Overview

What does API Security Misconfiguration mean?

API Security Misconfiguration is a security weakness caused by unsafe, incomplete, inconsistent, or default configuration in an API gateway, application, cloud service, framework, or supporting component.

How it works in practice

API security misconfiguration occurs when an otherwise functioning service is deployed with unsafe access rules or settings. Examples include unrestricted credentials, open debugging interfaces, missing TLS enforcement, overly broad CORS rules, verbose error leaks or disabled signature verification. Review begins with inventorying endpoints, environments, roles and secrets, then checking settings against a hardened baseline. Automated scans can detect patterns, but payment-specific authorization tests must verify that one merchant cannot read or alter another merchant's invoices or payouts.

Limits and common misunderstandings

CORS is a browser access control, not a replacement for server-side authentication. Rate limiting does not prevent an authorized key with excessive permissions from initiating a high-value transfer. Production secrets must never be exposed in frontend source.

Additional implementation considerations

A practical security review exercises authorization boundaries from the attacker's perspective. For instance, authenticate as merchant A and attempt to fetch merchant B's invoice by changing an ID. Repeat for payouts, API keys, callback URLs and export endpoints. Scan staging and production separately because permissive development settings often leak into deployment. Remediation should include secret rotation and evidence that corrected access checks work under all supported roles.

Related glossary terms

API Security Testing; Integration Credential; Live Mode

Further reference: Official documentation.