Status dokumen bukan klaim bahwa fiturnya sudah tersedia.
RFC dan proposal mencatat rancangan. Untuk kemampuan yang benar-benar dapat dipakai, lihat matriks kapabilitas runtime dan catatan rilis.
YAZA OWASP API Security Top 10:2023 Mapping
Status: Current-state mapping and proposed release checks; not an OWASP certification
Reviewed against repository status: 2026-10-28
Related: Security assurance proposal, Appendix H status, YAZA threat model
OWASP API Security Top 10:2023 is a risk-awareness list. This document maps those risk categories to YAZA's current API profile. A generated OpenAPI document or passing smoke test does not prove that an application is secure.
| ID | OWASP risk | Current YAZA position | Evidence gap and required check |
|---|---|---|---|
| API1:2023 | Broken Object Level Authorization | Shared Bearer and HS256 JWT authentication exist, but a typed principal, object ownership, and tenant policy are not implemented. Authentication alone does not authorize access to an object. | Add negative tests for foreign object IDs and cross-tenant reads/writes for every protected operation. Deny by default when ownership is unknown. |
| API2:2023 | Broken Authentication | Shared Bearer tokens require at least 32 bytes and yaza secret token generates OS-CSPRNG material. Route-scoped JWT validation supports HS256 only, pins issuer/audience, requires exp, checks optional nbf/iat, and compares signatures in fixed time. The HS256 secret is shared; sub is optional. |
Token issuance, typed principals, central revocation, JWT signing-key rotation, user credentials, OIDC/JWKS, and role/object authorization are absent. Two-slot overlap rotation is implemented for the shared service token only. A minimum-length check does not prove entropy. Test issuer/audience separation, expiry, malformed signatures, secret compromise, and configuration failure. |
| API3:2023 | Broken Object Property Level Authorization | Typed request shapes reject unknown fields on covered routes. Per-principal read/write field policy and response-property filtering are absent. | Define property-level allowlists for each role/operation; test mass assignment and sensitive response fields. |
| API4:2023 | Unrestricted Resource Consumption | HTTP/JSON sizes, connection count, request deadlines, response buffers, and some rate limits are bounded. Runtime-wide CPU/RSS/file-descriptor quotas and uniform work budgets are absent; synchronous handler/database work can stall other requests. | Exercise slow clients, expensive handlers, DB delays, queue saturation, and process memory/CPU limits. Verify bounded recovery under overload on every supported OS. |
| API5:2023 | Broken Function Level Authorization | Routes can be explicitly public, shared-token protected, or JWT protected. There is no general role/permission policy or typed authorization principal. | Build a route/method permission matrix and test anonymous, wrong-role, expired, and cross-tenant access. Public routes must be explicit. |
| API6:2023 | Unrestricted Access to Sensitive Business Flows | The framework does not provide a generic business-flow abuse policy or idempotency contract. | Applications must set per-flow quotas and abuse controls; provide idempotency keys for payments, orders, and other retry-sensitive effects. Test concurrent and repeated submissions. |
| API7:2023 | Server Side Request Forgery | A complete outbound HTTP client is not implemented, but low-level network capabilities exist. No general destination authorization policy is present. | Before adding an HTTP client, define egress allowlists, resolve and re-check IPv4/IPv6 addresses, block loopback/private/link-local/metadata destinations by default, constrain redirects, and bound connect/read/total time and response size. |
| API8:2023 | Security Misconfiguration | The API binds to loopback by default, requires authentication for non-loopback use under documented modes, and supports exact-origin CORS. Environment loading, allowed-host policy, trusted-proxy identity, and operational endpoint exposure need additional hardening. | Validate production configuration at startup; never trust forwarding headers from arbitrary peers; restrict metrics/readiness; test insecure template/configuration combinations. |
| API9:2023 | Improper Inventory Management | Route-derived OpenAPI and Postman artifacts help document declared endpoints. Operational endpoints, deployed hosts, API versions, and deprecation inventory are not fully managed. | Generate a versioned inventory for application and operational routes; compare deployed routes with OpenAPI; document deprecation and removal. |
| API10:2023 | Unsafe Consumption of APIs | PostgreSQL is the main external service. Broader outbound API clients are absent; PostgreSQL TLS policy and live interoperability evidence remain incomplete. | Validate remote TLS identity and response framing; bound response size and time; map external errors safely; add provider conformance tests before supporting more clients. |
Release gate
An API release is not ready for sensitive production data until the applicable category has a named owner, a passing negative test where relevant, and a documented residual risk. API1/API5 authorization, API2 credential lifecycle, API4 resource limits, API8 secure configuration, and database transport/authentication are mandatory for any non-loopback production deployment.