What security tests do you run against REST APIs?
- API security
- OWASP
- penetration testing
Answer it first, then compare. Nothing here is saved or scored.
Model answer
OWASP API Top 10 coverage: (1) BOLA/IDOR, access other users' resources by changing IDs. (2) Broken auth, test token manipulation, session fixation. (3) Excessive data exposure, verify response does not include sensitive fields. (4) Mass assignment, send extra fields and verify they are ignored. (5) SQL/NoSQL injection in query parameters. (6) SSRF, test internal URL blocking. (7) Security headers present (CORS, CSP). Tools: OWASP ZAP, Burp Suite, custom scripts. Run as part of CI, not just penetration testing.
What interviewers listen for
- Schema-first thinkingYou validate response shape before you assert on values, every time.
- Status-code literacyYou can defend why 401 vs 403 vs 422 matters for the consumer.
- Contract awarenessYou know when consumer-driven contract tests beat end-to-end checks.
- Auth fluencyYou can describe rotating tokens across parallel workers without secrets in logs.