Most explanations of the OWASP API Security Top 10 stop at a definition and a one-line mitigation: "validate object ownership", "implement rate limiting". A developer who can recite those lines still ships the bug, because the line does not say where the check goes or what it looks like in code.

This guide takes one small API and, for each risk in the 2023 edition (the current one), shows the code that breaks, the code that fixes it, and a test that keeps it fixed. The risks that cause the most damage get the most space. The last three are shorter, but each still ends in something you can paste.

The example API

Everything below uses the same service: a multi-tenant store API on Node.js 20, Express and PostgreSQL (the pg driver).…