Matter AI | Code Reviewer Documentation

API Security Vulnerabilities Overview

Broken Authentication

// Anti-pattern: Weak API authentication
app.post('/api/login', (req, res) => {
  const { username, password } = req.body;
  
  // Simple string comparison for authentication
  if (username === 'admin' && password === 'password123') {
    // Generate token without proper security measures
    const token = createSimpleToken(username);
    res.json({ token });
  } else {
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

// Better approach: Secure API authentication
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');

app.post('/api/login', async (req, res) => {
  try {
    const { username, password } = req.body;
    
    // Retrieve user from database
    const user = await User.findOne({ username });
    if (!user) {
      // Use consistent response time to prevent timing attacks
      await bcrypt.compare(password, '$2b$10$invalidhashforcomparison');
      return res.status(401).json({ error: 'Invalid credentials' });
    }
    
    // Verify password with secure comparison
    const isValid = await bcrypt.compare(password, user.passwordHash);
    if (!isValid) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }
    
    // Generate secure JWT with proper claims and expiration
    const token = jwt.sign(
      { 
        sub: user.id,
        username: user.username,
        roles: user.roles 
      },
      process.env.JWT_SECRET,
      { 
        expiresIn: '1h',
        issuer: 'your-api-name',
        audience: 'your-client-id'
      }
    );
    
    res.json({ 
      token,
      expiresIn: 3600 // seconds
    });
  } catch (error) {
    console.error('Login error:', error);
    res.status(500).json({ error: 'Authentication failed' });
  }
});

Broken authentication in APIs can allow attackers to compromise user accounts, gain unauthorized access, or impersonate legitimate users.

To implement secure API authentication:

Use strong, industry-standard authentication protocols (OAuth 2.0, JWT)
Implement proper password hashing and verification
Set appropriate token expiration times
Include necessary claims in tokens (issuer, audience, expiration)
Protect against brute force attacks with rate limiting
Use HTTPS for all authentication requests
Implement multi-factor authentication for sensitive operations

Broken Authorization

// Anti-pattern: Broken API authorization
app.get('/api/users/:id/profile', (req, res) => {
  const userId = req.params.id;
  
  // No authorization check, any authenticated user can access any profile
  getUserProfile(userId)
    .then(profile => res.json(profile))
    .catch(error => res.status(500).json({ error: 'Failed to get profile' }));
});

// Better approach: Proper API authorization
app.get('/api/users/:id/profile', authenticateJWT, (req, res) => {
  const userId = req.params.id;
  const requestingUserId = req.user.sub;
  
  // Check if user is accessing their own profile or has admin rights
  if (userId !== requestingUserId && !req.user.roles.includes('admin')) {
    return res.status(403).json({ error: 'Access denied' });
  }
  
  getUserProfile(userId)
    .then(profile => res.json(profile))
    .catch(error => res.status(500).json({ error: 'Failed to get profile' }));
});

Broken authorization in APIs can allow attackers to access resources or perform actions they should not be permitted to, potentially leading to data breaches or unauthorized modifications.

To implement secure API authorization:

Implement proper access control checks for all API endpoints
Use role-based or attribute-based access control
Validate that the authenticated user has permission for the requested resource
Implement the principle of least privilege
Use authorization tokens with appropriate scopes
Centralize authorization logic to prevent inconsistencies
Regularly audit and test authorization controls

Excessive Data Exposure

// Anti-pattern: Excessive data exposure
app.get('/api/users/:id', authenticateJWT, (req, res) => {
  const userId = req.params.id;
  
  // Returning the entire user object including sensitive data
  User.findById(userId)
    .then(user => res.json(user))
    .catch(error => res.status(500).json({ error: 'Failed to get user' }));
});

// Better approach: Controlled data exposure
app.get('/api/users/:id', authenticateJWT, (req, res) => {
  const userId = req.params.id;
  
  User.findById(userId)
    .then(user => {
      if (!user) {
        return res.status(404).json({ error: 'User not found' });
      }
      
      // Return only necessary, non-sensitive information
      const safeUserData = {
        id: user.id,
        username: user.username,
        name: user.name,
        email: user.email,
        createdAt: user.createdAt,
        // Exclude password, security questions, full address, etc.
      };
      
      res.json(safeUserData);
    })
    .catch(error => res.status(500).json({ error: 'Failed to get user' }));
});

Excessive data exposure occurs when APIs return more data than necessary, potentially exposing sensitive information to unauthorized parties.

To prevent excessive data exposure:

Filter sensitive data on the server before sending responses
Create specific data transfer objects (DTOs) for API responses
Implement proper data access controls
Use field-level permissions where appropriate
Consider using GraphQL to allow clients to request only needed fields
Regularly audit API responses for sensitive data
Implement proper error handling to prevent data leakage

Lack of Resources & Rate Limiting

// Anti-pattern: No rate limiting
app.post('/api/login', (req, res) => {
  // No rate limiting, vulnerable to brute force attacks
  authenticateUser(req.body)
    .then(token => res.json({ token }))
    .catch(error => res.status(401).json({ error: 'Authentication failed' }));
});

// Better approach: Implementing rate limiting
const rateLimit = require('express-rate-limit');

// Create rate limiter middleware
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 requests per window per IP
  standardHeaders: true,
  legacyHeaders: false,
  handler: (req, res) => {
    res.status(429).json({
      error: 'Too many login attempts, please try again after 15 minutes'
    });
  }
});

// Apply rate limiting to sensitive endpoints
app.post('/api/login', loginLimiter, (req, res) => {
  authenticateUser(req.body)
    .then(token => res.json({ token }))
    .catch(error => res.status(401).json({ error: 'Authentication failed' }));
});

// Global rate limiter for all API endpoints
const apiLimiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 100, // 100 requests per minute per IP
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many requests, please try again later' }
});

// Apply global rate limiting
app.use('/api/', apiLimiter);

Lack of resource and rate limiting can allow attackers to perform denial of service attacks or brute force attacks against the API.

To implement proper rate limiting:

Set appropriate limits for different API endpoints
Implement stricter limits for authentication endpoints
Use token bucket or sliding window algorithms for rate limiting
Include proper rate limit headers in responses
Implement exponential backoff for repeated failures
Consider using IP-based and user-based rate limiting
Monitor and adjust rate limits based on usage patterns

Broken Function Level Authorization

// Anti-pattern: Broken function level authorization
app.put('/api/articles/:id', authenticateJWT, (req, res) => {
  const articleId = req.params.id;
  const updates = req.body;
  
  // No function-level authorization check
  // Any authenticated user can update any article
  Article.findByIdAndUpdate(articleId, updates, { new: true })
    .then(article => res.json(article))
    .catch(error => res.status(500).json({ error: 'Failed to update article' }));
});

// Better approach: Proper function level authorization
app.put('/api/articles/:id', authenticateJWT, async (req, res) => {
  try {
    const articleId = req.params.id;
    const updates = req.body;
    const userId = req.user.sub;
    
    // Retrieve the article
    const article = await Article.findById(articleId);
    if (!article) {
      return res.status(404).json({ error: 'Article not found' });
    }
    
    // Check if user is the author or has editor/admin role
    if (article.authorId !== userId && 
        !req.user.roles.includes('editor') && 
        !req.user.roles.includes('admin')) {
      return res.status(403).json({ error: 'Not authorized to update this article' });
    }
    
    // Additional function-level checks
    if (updates.status === 'published' && 
        !req.user.roles.includes('editor') && 
        !req.user.roles.includes('admin')) {
      return res.status(403).json({ error: 'Only editors can publish articles' });
    }
    
    // Update the article
    const updatedArticle = await Article.findByIdAndUpdate(articleId, updates, { new: true });
    res.json(updatedArticle);
  } catch (error) {
    console.error('Update error:', error);
    res.status(500).json({ error: 'Failed to update article' });
  }
});

Broken function level authorization occurs when APIs fail to restrict access to specific functions or operations based on the user’s permissions, potentially allowing unauthorized actions.

To implement proper function level authorization:

Check permissions for each function or operation
Implement role-based access control for different operations
Validate ownership of resources before allowing modifications
Use attribute-based access control for complex permission scenarios
Centralize authorization logic in middleware or services
Implement proper error handling for authorization failures
Regularly audit and test function level authorization

Mass Assignment

// Anti-pattern: Mass assignment vulnerability
app.post('/api/users', authenticateJWT, (req, res) => {
  // Directly using request body without filtering
  // Attacker could include admin: true or role: 'admin' in the request
  const newUser = new User(req.body);
  
  newUser.save()
    .then(user => res.status(201).json(user))
    .catch(error => res.status(500).json({ error: 'Failed to create user' }));
});

// Better approach: Preventing mass assignment
app.post('/api/users', authenticateJWT, (req, res) => {
  // Explicitly specify which fields can be set
  const { username, email, name, password } = req.body;
  
  // Create user with only allowed fields
  const newUser = new User({
    username,
    email,
    name,
    password,
    // Default values for protected fields
    role: 'user',
    isAdmin: false,
    verified: false
  });
  
  newUser.save()
    .then(user => res.status(201).json(user))
    .catch(error => res.status(500).json({ error: 'Failed to create user' }));
});

Mass assignment vulnerabilities occur when APIs automatically bind client-provided data to internal objects or database models without proper filtering, potentially allowing attackers to modify fields they should not have access to.

To prevent mass assignment:

Explicitly specify which fields can be set from user input
Use whitelisting instead of blacklisting for allowed fields
Create separate data transfer objects (DTOs) for input
Implement property-level access controls
Use framework features that prevent mass assignment
Regularly audit model properties for sensitive fields
Implement proper validation for all input fields

Security Misconfiguration

// Anti-pattern: API security misconfiguration
const express = require('express');
const app = express();

// Missing security headers
// No CORS configuration
// No HTTPS enforcement

app.use(express.json());

// Exposing detailed error information
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({
    error: err.message,
    stack: err.stack
  });
});

// Better approach: Proper security configuration
const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const app = express();

// Add security headers
app.use(helmet());

// Configure CORS
const corsOptions = {
  origin: ['https://example.com', 'https://www.example.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  maxAge: 86400 // 24 hours
};
app.use(cors(corsOptions));

// Force HTTPS in production
if (process.env.NODE_ENV === 'production') {
  app.use((req, res, next) => {
    if (req.header('x-forwarded-proto') !== 'https') {
      return res.redirect(`https://${req.header('host')}${req.url}`);
    }
    next();
  });
}

app.use(express.json({ limit: '100kb' })); // Limit request size

// Sanitized error handler
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({
    error: 'An unexpected error occurred',
    // No stack trace or detailed error in production
    ...(process.env.NODE_ENV !== 'production' && { detail: err.message })
  });
});

Security misconfiguration in APIs can expose sensitive information, enable attacks, or provide attackers with information useful for exploiting other vulnerabilities.

To prevent security misconfiguration:

Use security headers (Content-Security-Policy, X-Content-Type-Options, etc.)
Configure CORS properly to restrict access to trusted domains
Enforce HTTPS for all API traffic
Limit request sizes to prevent denial of service
Use secure cookie settings (HttpOnly, Secure, SameSite)
Implement proper error handling that doesn’t leak sensitive information
Disable unnecessary features, methods, and debugging information
Regularly update dependencies and frameworks

Improper Assets Management

// Anti-pattern: Improper API assets management
// Outdated API still accessible
app.get('/api/v1/users', (req, res) => {
  // Old, insecure implementation
  // No deprecation notice
  // No migration path
  db.query('SELECT * FROM users', (err, results) => {
    if (err) return res.status(500).json({ error: err.message });
    res.json(results);
  });
});

// Better approach: Proper API assets management
// Clear versioning and deprecation strategy
app.get('/api/v1/users', (req, res) => {
  // Add deprecation header
  res.set({
    'Deprecation': 'true',
    'Sunset': new Date(Date.now() + 6 * 30 * 24 * 60 * 60 * 1000).toUTCString(), // 6 months
    'Link': '</api/v2/users>; rel="successor-version"'
  });
  
  // Log deprecation access for monitoring
  console.log('Deprecated API accessed:', req.path, 'by', req.ip);
  
  // Still handle the request securely
  User.find({}, 'id username name email createdAt')
    .then(users => res.json(users))
    .catch(error => res.status(500).json({ error: 'Failed to retrieve users' }));
});

// New version with improved security
app.get('/api/v2/users', authenticateJWT, (req, res) => {
  // New, more secure implementation
  User.find({}, 'id username name email createdAt')
    .then(users => res.json(users))
    .catch(error => res.status(500).json({ error: 'Failed to retrieve users' }));
});

Improper assets management can lead to the exposure of deprecated API versions, test endpoints, or debug information that may contain vulnerabilities or sensitive information.

To implement proper API assets management:

Maintain an inventory of all API endpoints and versions
Implement a clear versioning strategy
Use proper deprecation notices and sunset headers
Provide migration paths for deprecated APIs
Remove or secure test and debug endpoints in production
Regularly audit and update API documentation
Monitor usage of deprecated APIs
Implement proper access controls for all API versions

Insufficient Logging & Monitoring

// Anti-pattern: Insufficient logging and monitoring
app.post('/api/login', (req, res) => {
  const { username, password } = req.body;
  
  // No logging of authentication attempts
  authenticateUser(username, password)
    .then(token => res.json({ token }))
    .catch(error => res.status(401).json({ error: 'Authentication failed' }));
});

// Better approach: Proper logging and monitoring
const winston = require('winston');

// Configure logger
const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  defaultMeta: { service: 'api-service' },
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' }),
    // In production, consider adding transports for centralized logging
  ],
});

app.post('/api/login', (req, res) => {
  const { username } = req.body;
  const ip = req.ip;
  const userAgent = req.headers['user-agent'];
  
  // Log authentication attempt (without password)
  logger.info('Login attempt', {
    username,
    ip,
    userAgent,
    path: req.path,
    method: req.method
  });
  
  authenticateUser(req.body)
    .then(token => {
      // Log successful authentication
      logger.info('Login successful', {
        username,
        ip,
        userAgent
      });
      
      res.json({ token });
    })
    .catch(error => {
      // Log failed authentication
      logger.warn('Login failed', {
        username,
        ip,
        userAgent,
        reason: error.message
      });
      
      res.status(401).json({ error: 'Authentication failed' });
    });
});

// Log all API requests
app.use((req, res, next) => {
  const startTime = Date.now();
  
  // Log when response is sent
  res.on('finish', () => {
    const duration = Date.now() - startTime;
    const logLevel = res.statusCode >= 400 ? 'warn' : 'info';
    
    logger[logLevel]('API request', {
      method: req.method,
      path: req.path,
      statusCode: res.statusCode,
      duration,
      ip: req.ip,
      userAgent: req.headers['user-agent'],
      userId: req.user ? req.user.sub : 'anonymous'
    });
  });
  
  next();
});

Insufficient logging and monitoring can prevent the detection of security incidents, hinder forensic analysis, and delay incident response.

To implement proper logging and monitoring:

Log all authentication events (successes and failures)
Log access to sensitive data and functions
Include relevant details in logs (timestamp, user, IP, action)
Implement centralized log collection and analysis
Set up alerts for suspicious activity
Ensure logs are protected from tampering
Implement proper log retention policies
Regularly review and analyze logs for security incidents

Insecure API Documentation

// Anti-pattern: Insecure API documentation
// Exposing sensitive information in documentation
/**
 * @api {post} /api/payments Process payment
 * @apiName ProcessPayment
 * @apiGroup Payments
 * @apiParam {String} creditCardNumber User's credit card number
 * @apiParam {String} cvv CVV code
 * @apiParam {String} expiryDate Expiry date (MM/YY)
 * @apiParam {Number} amount Payment amount
 * 
 * @apiExample {curl} Example usage:
 *     curl -X POST -H "Content-Type: application/json" -d '{
 *       "creditCardNumber": "4111111111111111",
 *       "cvv": "123",
 *       "expiryDate": "12/25",
 *       "amount": 100
 *     }' https://api.example.com/api/payments
 */

// Better approach: Secure API documentation
/**
 * @api {post} /api/payments Process payment
 * @apiName ProcessPayment
 * @apiGroup Payments
 * @apiParam {String} paymentToken Secure token from payment processor
 * @apiParam {Number} amount Payment amount
 * 
 * @apiExample {curl} Example usage:
 *     curl -X POST -H "Content-Type: application/json" -d '{
 *       "paymentToken": "tok_visa",
 *       "amount": 100
 *     }' https://api.example.com/api/payments
 * 
 * @apiSecurity JWT
 * @apiPermission user
 */

Insecure API documentation can expose sensitive information, implementation details, or examples that could be used by attackers to exploit vulnerabilities.

To implement secure API documentation:

Avoid including sensitive data in examples
Use placeholders or tokens instead of real credentials
Clearly document authentication and authorization requirements
Include information about rate limits and security controls
Restrict access to detailed API documentation
Regularly review and update documentation
Remove internal implementation details from public documentation
Provide security guidelines for API consumers

Introduction

Getting Started

Product

Patterns

Integrations

Enterprise

API Security Vulnerabilities