How do you approach security testing for APIs?
- security testing
- OWASP
- penetration testing
Answer it first, then compare. Nothing here is saved or scored.
Model answer
Key areas: (1) Injection, SQL injection, NoSQL injection, command injection in parameters. (2) Broken auth - test with expired/invalid/missing tokens, horizontal privilege escalation (access other users' data). (3) Mass assignment - send extra fields to see if the API blindly accepts them. (4) Rate limiting - verify limits are enforced. (5) CORS - verify allowed origins. (6) Input validation - boundary values, special characters, oversized payloads. Tools: OWASP ZAP, Burp Suite for automated scanning.
What interviewers listen for
- Schema-first thinkingYou validate response shape before you assert on values, every time.
- Status-code literacyYou can defend why 401 vs 403 vs 422 matters for the consumer.
- Contract awarenessYou know when consumer-driven contract tests beat end-to-end checks.
- Auth fluencyYou can describe rotating tokens across parallel workers without secrets in logs.