Designing a secure API
P57.secure-api-design.01 · Audience: guest, it-ml, language-pro · Prerequisites: Access-control bugs & the OWASP lens
Individual bug fixes matter, but the design decides how many bugs are even possible. This module covers where authN and authZ live, what belongs at the request boundary, and the detail teams most often get wrong: error hygiene. A login that distinguishes "no such user" from "wrong password" hands attackers a free user-enumeration oracle.
Ask the mentor about this module
Ask a question about this content. The mentor explains and grounds its answer in what you are studying; asking is recorded as a learning signal, not a grade.
Keeping your files on this device
Off by default. The mentor always gets your file; this only decides whether your own copy stays here. Copies live in this browser only - they do not follow you to another device, and clearing site data removes them.
Rung 1 — error hygiene: don't build an oracle
Loading exercise…
Interview rung — designing a secure API (free-form)
Loading exercise…
My notes on this module
Loading your notes...
Where next?
Later in Secure API Design