Where Security Misconfiguration hides in an API deployment.
Six distinct areas — each with its own failure mode, each exploitable independently.
🌐
CORS Policy
Cross-Origin Resource Sharing controls which websites can call your API from a browser. Misconfigured: allows any origin, or reflects the caller’s origin without an allowlist, enabling attacker-controlled sites to make authenticated requests to your API.
💬
Error Messages
API error responses expose stack traces, SQL queries, internal file paths, framework versions, or environment details. Gives attackers a map of the system’s internals.
📋
Security Headers
Missing HTTP response headers: HSTS (forces HTTPS), Content-Security-Policy (restricts resource loading), X-Content-Type-Options, X-Frame-Options. Each missing header removes a browser-level defense.
🔧
HTTP Methods
Endpoints that should only accept GET or POST also respond to DELETE, PUT, PATCH, or OPTIONS with full functionality. Attackers call unexpected methods to trigger unintended behavior.
🔒
TLS Configuration
API served over HTTP (no encryption), or accepts deprecated TLS versions (1.0, 1.1) or weak cipher suites. Allows traffic interception and downgrade attacks.
🛠️
Debug and Admin Endpoints
Development endpoints (/debug, /actuator, /admin, /console, /metrics, /health) deployed to production, often without authentication or with default credentials. Exposes internals or allows unauthorized control.