English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

APIs have become the prominent technology of choice for achievinginter-service communications. The growth of API deployments has driven theurgency in addressing its lack of security standards. API Security is a topicfor concern given the absence of standardized authorization in the OpenAPIstandard, improper authorization opens the possibility for known and unknownvulnerabilities, which in the past years have been exploited by maliciousactors resulting in data loss. This paper examines the number one vulnerabilityin API Security: Broken Object Level Authorization(BOLA), and proposes methodsand tools to reduce the prevalence of this vulnerability. BOLA affects variousAPI frameworks, our scope is fixated on the OpenAPI Specification(OAS). The OASis a standard for describing and implementing APIs; popular OAS Implementationsare FastAPI, Connexion (Flask), and many more. These implementations carry thepros and cons that are associated with the OASs knowledge of API properties.The Open API Specifications security properties do not address objectauthorization and provide no standardized approach to define such objectproperties. This leaves object-level security at the mercy of developers, whichpresents an increased risk of unintentionally creating attack vectors. Our aimis to tackle this void by introducing 1) the OAS ESS (OpenAPI SpecificationExtended Security Scheme) which includes declarative security controls forobjects in OAS (design-based approach), and 2) an authorization module that canbe imported to API services (Flask/FastAPI) to enforce authorization checks atthe object level (development-based approach). When building an API service, adeveloper can start with the API design (specification) or its code. In bothcases, a set of mechanisms are introduced to help developers mitigate andreduce the prevalence of BOLA.

OpenAPI Specification Extended Security Scheme: A method to reduce the prevalence of Broken Object Level Authorization