RedSec
28 lessons

API security

REST, GraphQL, authorization, schema review, and safe API testing.

  1. 001 REST endpoint inventory Learn REST endpoint inventory through a safe, repeatable api security workflow. intro tutorial 20 min
  2. 002 GraphQL schema reading Learn GraphQL schema reading through a safe, repeatable api security workflow. intro tutorial 20 min
  3. 003 API versioning and shadow endpoints Learn API versioning and shadow endpoints through a safe, repeatable api security workflow. intro tutorial 20 min
  4. 004 Mass assignment review Learn Mass assignment review through a safe, repeatable api security workflow. intro tutorial 20 min
  5. 005 Pagination and object enumeration Learn Pagination and object enumeration through a safe, repeatable api security workflow. intro tutorial 20 min
  6. 006 Rate limiting and abuse cases Learn Rate limiting and abuse cases through a safe, repeatable api security workflow. intro tutorial 20 min
  7. 007 Webhook security basics Learn Webhook security basics through a safe, repeatable api security workflow. intro reference 12 min
  8. 008 API token handling Learn API token handling through a safe, repeatable api security workflow. intro tutorial 20 min
  9. 009 Schema validation patterns Learn Schema validation patterns through a safe, repeatable api security workflow. core lab 30 min
  10. 010 Testing API authorization Learn Testing API authorization through a safe, repeatable api security workflow. core tutorial 20 min
  11. 011 OpenAPI specification review Learn OpenAPI specification review through a safe, repeatable api security workflow. core tutorial 20 min
  12. 012 GraphQL introspection review Learn GraphQL introspection review through a safe, repeatable api security workflow. core tutorial 20 min
  13. 013 GraphQL resolver authorization Learn GraphQL resolver authorization through a safe, repeatable api security workflow. core tutorial 20 min
  14. 014 GraphQL batching and depth limits Learn GraphQL batching and depth limits through a safe, repeatable api security workflow. core reference 12 min
  15. 015 REST nested resource authorization Learn REST nested resource authorization through a safe, repeatable api security workflow. core tutorial 20 min
  16. 016 PUT vs PATCH behavior Learn PUT vs PATCH behavior through a safe, repeatable api security workflow. core tutorial 20 min
  17. 017 JSON merge patch risks Learn JSON merge patch risks through a safe, repeatable api security workflow. core tutorial 20 min
  18. 018 Bulk update endpoint review Learn Bulk update endpoint review through a safe, repeatable api security workflow. core lab 30 min
  19. 019 Batch import endpoint review Learn Batch import endpoint review through a safe, repeatable api security workflow. core tutorial 20 min
  20. 020 API object lifecycle testing Learn API object lifecycle testing through a safe, repeatable api security workflow. core tutorial 20 min
  21. 021 API filtering and sorting abuse Learn API filtering and sorting abuse through a safe, repeatable api security workflow. core reference 12 min
  22. 022 API error shape triage Learn API error shape triage through a safe, repeatable api security workflow. core tutorial 20 min
  23. 023 JWT bearer token review Learn JWT bearer token review through a safe, repeatable api security workflow. core tutorial 20 min
  24. 024 API key prefix and scope review Learn API key prefix and scope review through a safe, repeatable api security workflow. core tutorial 20 min
  25. 025 Webhook signature verification Learn Webhook signature verification through a safe, repeatable api security workflow. core tutorial 20 min
  26. 026 Idempotency key abuse cases Learn Idempotency key abuse cases through a safe, repeatable api security workflow. advanced tutorial 35 min
  27. 027 Mobile API traffic capture Learn Mobile API traffic capture through a safe, repeatable api security workflow. advanced lab 45 min
  28. 028 gRPC service review basics Learn gRPC service review basics through a safe, repeatable api security workflow. advanced reference 12 min