Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build an API with real authentication/authorization and prove it: OAuth2/JWT or scoped API keys, per-object ownership checks on every resource access, field whitelisting against mass assignment, and bounded resource consumption. Then write a short threat model against the OWASP API Security Top 10, with tests demonstrating that BOLA and mass-assignment attempts are rejected.
Token/key auth with scopes enforced; deny-by-default; credentials only via the Authorization header over TLS.
Per-object ownership checked on every access (incl. lists); privileged functions role-gated; BOLA/BFLA rejection is tested.
Field whitelisting (no mass assignment); only necessary data returned; every input validated.
A written OWASP API Top 10 assessment maps each risk to its specific defense in the code.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Secured API with auth, scopes, and an OWASP audit ## Goal Build an API with real authentication/authorization and prove it: OAuth2/JWT or scoped API keys, per-object ownership checks on every resource access, field whitelisting against mass assignment, and bounded resource consumption. Then write a short threat model against the OWASP API Security Top 10, with tests demonstrating that BOLA and mass-assignment attempts are rejected. ## Acceptance criteria - [ ] Authentication & scopes: Token/key auth with scopes enforced; deny-by-default; credentials only via the Authorization header over TLS. - [ ] Object & function authorization: Per-object ownership checked on every access (incl. lists); privileged functions role-gated; BOLA/BFLA rejection is tested. - [ ] Data & input safety: Field whitelisting (no mass assignment); only necessary data returned; every input validated. - [ ] Threat model: A written OWASP API Top 10 assessment maps each risk to its specific defense in the code. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.