API Security

Most REST APIs ship with two kinds of tests: unit tests that check functions in isolation, and integration tests that walk the happy path. “Create an item, read it back, delete it, get a 204.” Those tests are written by the same people who wrote the code, so they test the inputs those people expected. Nobody writes the test that sends a 65-character name, a quantity of 2^64, or a DELETE for an item that was never created, because nobody thought of it. ...

Most security monitoring tools rely on server-side logs or cloud-native telemetry. But what happens when the client is opaque? When a mobile app, a single-page application (SPA), or a proprietary service is behaving in ways the server doesn’t fully document, you need a way to look at the wire directly. This post also marks the beginning of a new experiment: The Rabbit Hole Series. Every Friday, a “Rabbit Hole Generator” I built (which I later took apart in its own post) spits out a new technical topic for me to explore for 30 minutes. This week, the generator gave me mitmproxy. ...