aura-labs.ai

API Security Baseline — OWASP API Security Top 10

This document maps each OWASP API Security Top 10 (2023) category to a concrete, testable requirement for the AURA Core API. Every endpoint must satisfy the applicable requirements before merge. This is the reference standard for Feature Readiness Gate 2.

This baseline is not aspirational. It is the minimum bar. If a requirement says “must,” the PR cannot merge without it.

How to Use This Document

When building a new endpoint or modifying an existing one:

  1. Read the requirements below that apply to your change.
  2. Write security acceptance criteria into your PR description before writing code.
  3. Implement the endpoint to satisfy those criteria.
  4. Write tests that verify the security behaviour (see Gate 5 in FEATURE_READINESS.md).
  5. Reference the specific API-n category in your PR description so reviewers know what was considered.

API1: Broken Object Level Authorization (BOLA)

Every endpoint that accepts a resource identifier (session ID, transaction ID, offer ID, agent ID) must verify that the requesting agent owns or is authorized to access that resource.

Requirements:

Test pattern:

test('agent A cannot read agent B session', async () => {
  // Create session as agent A
  const session = await createSessionAs(agentA);
  // Try to read it as agent B
  const res = await getSessionAs(agentB, session.id);
  assert.equal(res.statusCode, 403);
});

API2: Broken Authentication

Every state-changing endpoint and every endpoint that returns non-public data must require authentication via Ed25519 signature verification (verifyAgent preHandler).

Requirements:

API3: Broken Object Property Level Authorization (BOPLA)

Responses must not expose properties that the requesting agent is not authorized to see.

Requirements:

Test pattern:

test('beacon cannot see session constraints', async () => {
  const session = await createSessionAs(scout);
  const res = await getSessionAs(beacon, session.id);
  assert.equal(res.json().constraints, undefined);
});

API4: Unrestricted Resource Consumption

Every list endpoint must enforce pagination. Every request must enforce size limits.

Requirements:

API5: Broken Function Level Authorization (BFLA)

Endpoints must enforce authorization based on the agent’s role and the action being performed, not just authentication.

Requirements:

Test pattern:

test('beacon agent cannot create sessions', async () => {
  const res = await createSessionAs(beaconAgent);
  assert.equal(res.statusCode, 403);
});

API6: Unrestricted Access to Sensitive Business Flows

Business-critical flows must have protections against abuse, replay, and automation.

Requirements:

API7: Server-Side Request Forgery (SSRF)

Any endpoint or component that makes outbound HTTP requests based on user-supplied URLs must validate the destination.

Requirements:

Test pattern:

test('rejects webhook URL pointing to private IP', async () => {
  const res = await registerBeacon({ endpointUrl: 'https://192.168.1.1/webhook' });
  assert.equal(res.statusCode, 400);
  assert.match(res.json().message, /private|internal|not allowed/i);
});

API8: Security Misconfiguration

The application must be configured securely by default with no manual hardening required.

Requirements:

API9: Improper Inventory Management

API versions, deprecated endpoints, and documentation must be actively managed.

Requirements:

API10: Unsafe Consumption of APIs

Outbound API calls must authenticate and validate responses.

Requirements:

Cross-Cutting Requirements

These apply to every endpoint regardless of category:

Compliance Tracking

Each endpoint in the codebase should be annotated with the OWASP categories it has been verified against. The format is a comment at the top of each route handler:

// Security: API1 (BOLA), API2 (Auth), API3 (BOPLA), API5 (BFLA)
app.get('/v1/sessions/:sessionId', { preHandler: verifyAgent }, async (request, reply) => {

This makes it visible during code review which categories have been considered and which have not.