You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: skills/appsec/api-security/SKILL.md
+114-1Lines changed: 114 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,11 +38,120 @@ Before analyzing any endpoint, establish a complete inventory of the API surface
38
38
5.**Catalog data objects** -- List the resources/entities exposed by the API and their sensitivity classification (PII, financial, internal, public).
39
39
6.**Note rate limiting and quota configurations** -- Document any existing throttling, quota, or cost-control mechanisms at the gateway or application layer.
40
40
7.**Identify downstream dependencies** -- Third-party APIs, internal microservices, or webhooks that the API consumes.
41
+
8.**Capture effective method and route handling** -- Document reverse proxy rewrites, method override headers, trailing-slash behavior, encoded slash handling, and any gateway-to-application route or method differences. If the API sits behind a gateway or CDN, record the gateway-visible route and the application-visible route separately.
41
42
42
43
> **Gate:** Do not proceed until the API style, authentication model, authorization model, and endpoint inventory are documented. Incomplete scope leads to missed findings.
43
44
45
+
46
+
44
47
---
45
48
49
+
## Step 1A: Effective Method and Route Normalization
50
+
51
+
Before assigning API1/API5/API8/API9 findings, verify which HTTP method and path the authorization layer actually evaluates after proxies, gateways, framework routing, and compatibility middleware have transformed the request. A mismatch between the documented route and the effective route is one of the most common sources of broken function-level authorization.
52
+
53
+
### What to look for
54
+
55
+
-**Method override support** -- Headers such as `X-HTTP-Method-Override`, `X-HTTP-Method`, `X-Method-Override`, query/body parameter `_method`, or framework middleware that transforms the HTTP method (e.g., Spring'''s `HiddenHttpMethodFilter`, Express `method-override`, ASP.NET `UseHttpMethodOverride`).
56
+
-**Gateway or CDN rewrites** -- Rules that authorize one path or method while forwarding a rewritten path or method to the application (e.g., nginx `proxy_pass` trailing slash rewrite, AWS ALB target group path rewriting, Envoy `prefix_rewrite`).
57
+
-**Route normalization differences** -- Trailing slashes, case sensitivity, duplicate slashes, encoded slashes (`%2f`), semicolon or matrix parameters (`;key=val`), percent-decoding order, and HTTP/2 pseudo-header routing.
58
+
-**OpenAPI-vs-code method drift** -- Operations that list `GET`/`POST` only while application routes or middleware accept additional methods such as `PUT`, `PATCH`, or `DELETE`.
59
+
-**Authorization placement** -- Whether authorization checks run before or after the final route/method is selected, especially in reverse proxy, API gateway, service mesh, and framework-level middleware deployments.
60
+
61
+
### Vulnerable examples
62
+
63
+
```http
64
+
# Method override bypasses POST-only authorization to reach DELETE
65
+
POST /api/users/123 HTTP/1.1
66
+
X-HTTP-Method-Override: DELETE
67
+
Authorization: Bearer user-token
68
+
```
69
+
70
+
```nginx
71
+
# Gateway authorizes /api/public/ but application receives /internal/
72
+
location /api/public/ {
73
+
proxy_pass http://app/internal/;
74
+
}
75
+
```
76
+
77
+
```http
78
+
# Encoded slash bypasses path-based authorization
79
+
GET /api/tenants/acme%2fadmin/users HTTP/1.1
80
+
```
81
+
82
+
```http
83
+
# Duplicate slash bypasses route-level policy
84
+
GET /api//admin/users HTTP/1.1
85
+
```
86
+
87
+
### Benign example (not a finding)
88
+
89
+
```yaml
90
+
gateway:
91
+
route: /api/accounts/{id}
92
+
methods: [GET, PATCH]
93
+
normalize_path_before_authz: true
94
+
reject_encoded_slash: true
95
+
method_override: disabled
96
+
97
+
application:
98
+
route: /api/accounts/{id}
99
+
methods: [GET, PATCH]
100
+
authorization_policy: AccountOwnerOrAdmin
101
+
```
102
+
103
+
**Why this is safe:** The gateway and application both evaluate the same effective method and path. Unsupported methods return `405`, encoded slashes are rejected, method override is disabled, and the authorization policy applies consistently at both layers.
104
+
105
+
### Detection methods using allowed tools
106
+
107
+
```
108
+
# Find method override and route rewrite handling
109
+
Grep: "X-HTTP-Method-Override|X-HTTP-Method|X-Method-Override|_method|methodOverride|UseHttpMethodOverride|HiddenHttpMethodFilter|HttpMethodOverride" in **/*.{js,ts,py,go,java,cs,rb,php,yaml,yml,xml,conf,tf}
110
+
Grep: "rewrite|proxy_pass|PathPrefix|stripPrefix|ReplacePath|map\s*\{|location\s+/|allow_methods|methods:" in **/*.{yaml,yml,json,conf,tf,ts,js,go,java,cs,py,rb,php}
111
+
112
+
# Find normalization-sensitive routing and authorization code
113
+
Grep: "AllowEncodedSlashes|UsePathBase|PathString|RawTarget|OriginalPath|Request\.Path|UrlDecode|decodeURIComponent|unquote|urldecode" in **/*.{cs,java,go,js,ts,py,rb,php,conf}
114
+
Grep: "RequireAuthorization|authorize|permission|policy|roles|scope|isAuthenticated|check_permission|access_control" in **/*.{cs,java,go,js,ts,py,rb,php}
115
+
Grep: "405|MethodNotAllowed|method_not_allowed|NotAllowed" in **/*.{cs,java,go,js,ts,py,rb,php,yaml,yml}
| Method override can reach privileged operations without the same authorization as the effective method | API5:2023 | **High** |
134
+
| Gateway authorizes a normalized or documented route but forwards a different effective route to the application | API5:2023 / API9:2023 | **High** |
135
+
| Encoded slash, duplicate slash, semicolon, or case normalization bypasses route-level authorization | API1:2023 / API5:2023 | **High** |
136
+
| OpenAPI spec omits accepted methods or paths that exist in code or gateway config | API9:2023 | **Medium** |
137
+
| Method allowlist is absent and unsupported methods do not return `405 Method Not Allowed` | API8:2023 | **Medium** |
138
+
| Method override is enabled globally without scoping to specific legacy routes | API8:2023 | **Low** |
139
+
| Gateway rewrite table is undocumented but functionally consistent with application authorization | API9:2023 | **Low** |
140
+
141
+
### Normalization verification checklist
142
+
143
+
Before closing a method/route-related finding, confirm all of the following:
144
+
145
+
- [ ] The HTTP method observed by the authorization layer matches the effective method after any override is applied.
146
+
- [ ] The path evaluated for authorization matches the path the application routes to after proxy rewrites, percent-decoding, and normalization.
147
+
- [ ] Method override middleware (if present) is scoped to specific legacy routes and its output is authorized as the effective method.
148
+
- [ ] Encoded slashes, duplicate slashes, case differences, and semicolon parameters are either rejected or normalized consistently before authorization.
149
+
- [ ] Unsupported HTTP methods return `405 Method Not Allowed` and the allowlist is documented.
150
+
- [ ] The OpenAPI spec (if present) lists all methods and paths the application actually accepts.
151
+
- [ ] Gateway rewrite rules are part of the endpoint inventory and the application still enforces object/function authorization on the rewritten route.
152
+
153
+
> **Gate:** Treat authorization evidence as incomplete unless it states the method/path observed by the gateway and the method/path enforced by the application after normalization. Do not mark method or route findings as resolved without verified evidence from both layers.
154
+
46
155
## Steps 2-11: OWASP API Security Top 10:2023 Evaluation (API1-API10)
47
156
48
157
Evaluate the API against all ten OWASP API Security Top 10:2023 risk categories: Broken Object Level Authorization (BOLA), Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA), Unrestricted Access to Sensitive Business Flows, Server Side Request Forgery (SSRF), Security Misconfiguration, Improper Inventory Management, and Unsafe Consumption of APIs.
@@ -141,7 +250,7 @@ The final review output must be structured as follows:
@@ -215,6 +324,8 @@ Unlike REST, where authorization can be enforced per endpoint, GraphQL requires
215
324
216
325
6.**Ignoring upstream API trust.** Data received from third-party APIs and even internal microservices must be validated before use. A compromised upstream service can inject SQL, XSS, or SSRF payloads through otherwise trusted data channels.
217
326
327
+
7.**Authorizing the pre-rewrite request instead of the effective request.** API gateways, reverse proxies, and frameworks can rewrite paths or override methods before the application handles the request. If authorization evidence only covers the documented path/method, a hidden DELETE, PATCH, or rewritten admin route can bypass API5 controls.
328
+
218
329
---
219
330
220
331
## Prompt Injection Safety Notice
@@ -238,4 +349,6 @@ This skill is hardened against prompt injection. When reviewing API code and spe
0 commit comments