This guide covers OWASP-based security testing for APIs.
The framework includes comprehensive security tests based on the OWASP Top 10 API Security Risks.
# Run all security tests
npm run test:security
# Or directly with Jest
jest --testPathPattern=securityTests for:
- Unauthorized access attempts
- IDOR (Insecure Direct Object Reference)
- Privilege escalation
it('should not allow unauthorized access', async () => {
const response = await client.get('/admin/users');
expect(response.status).not.toBe(200);
});Tests for:
- HTTPS enforcement
- Sensitive data exposure
- Weak encryption
it('should not expose sensitive data', async () => {
const response = await client.get('/users/1');
expect(response.data).not.toHaveProperty('password');
});Tests for:
- SQL injection
- NoSQL injection
- Command injection
- LDAP injection
const sqlPayloads = [
"'; DROP TABLE users; --",
"1' OR '1'='1",
];
for (const payload of sqlPayloads) {
const response = await client.post('/posts', { title: payload });
expect(response.status).toBe(201); // Should treat as string
}Tests for:
- Rate limiting
- Business logic flaws
- Missing security controls
Tests for:
- Server information disclosure
- CORS configuration
- Default credentials
Tests for:
- Malformed request handling
- Error disclosure
Tests for:
- Weak password policies
- Session management
- Token security
Tests for:
- Data integrity validation
- Response tampering
Tests for:
- Security event logging
- Audit trail
Tests for:
- SSRF attempts via URL parameters
- Internal network access
const xssPayloads = [
'<script>alert("XSS")</script>',
'<img src="x" onerror="alert(1)">',
'javascript:alert(1)',
];
for (const payload of xssPayloads) {
const response = await client.post('/posts', { title: payload });
expect(response.data.title).toBe(payload); // Stored as-is
}Validate security headers:
it('should have security headers', async () => {
const response = await client.get('/users');
// Check recommended headers
expect(response.headers['x-content-type-options']).toBe('nosniff');
expect(response.headers['x-frame-options']).toBe('DENY');
});Use comprehensive payload lists:
- OWASP Fuzzing Database
- SecLists
- Custom payloads
// Test token expiration
const expiredToken = jwt.generateExpiredToken({ userId: 1 });
const result = jwt.validateToken(expiredToken);
expect(result.valid).toBe(false);// Test rate limits
const requests = Array.from({ length: 100 }, () =>
client.get('/users')
);
const responses = await Promise.all(requests);
const rateLimited = responses.filter(r => r.status === 429);
expect(rateLimited.length).toBeGreaterThan(0);- Authentication bypass testing
- Authorization testing
- Input validation testing
- Session management testing
- Error handling testing
- Business logic testing
- Data validation testing
- File upload testing
- API rate limiting testing
- CORS testing
For more information, see the main README.md.