0

There is the OWASP Top 10 which is the most known one: https://owasp.org/www-project-top-ten/

And there is the OWASP Top 10 API: https://owasp.org/www-project-api-security/

Both lists are very similar, so I am confused why there are 2 lists noting that APIs are very similar to web applications. And another point is that the API list is updated (2023) while the regular list last updated was in 2021.

So what is the difference between the 2 lists that are generated by OWASP? and which list should I follow I am testing a web application exposing APIs?

Improve this question
4
  • I'm not seeing how they are the "same" ...
    – schroeder ♦
    Commented Jun 12, 2023 at 14:15
  • Hello @schroeder, I did not same the "same", I said they are "very similar". Maybe I'm not seeing the differences well so that's why I raised the question.
    – ethicalhacker
    Commented Jun 13, 2023 at 8:48
  • 1
    Sorry, maybe I should have refrased my question in a different way. So why do we have 2 different lists one for web application and the other for API? can't the OWASP top 10 cover apis ? and what is so specific on the api list that it has its own list of risks? I hope this explains my confusion . Becuase now If I have a web application that I want to test and for sure every web application has apis , which list should I use ?
    – ethicalhacker
    Commented Jun 13, 2023 at 8:56
  • Again, I'm not sure what your confusion is. They are clearly for different purposes and there is very little overlap or focus.
    – schroeder ♦
    Commented Jun 13, 2023 at 10:28

2 Answers 2

Reset to default
0

There are actually a lot of differences and maybe some have similar titles but the order and content is different.

The goal of OWASP is to provide application security advisory (OWASP - Open Worldwide Application Security Project) and API's are a part of it as well. There is a TOP 10 for those interested in API based vulnerabilities just as there is a TOP 10 for Serverless (see here) which also has application security issues.

Every application needs to be considered separately, an API is a separate application.

Improve this answer
1
  • thank you for the reply. Can you please check my comment above ? I tried to rephrase my question on a different way to better explain why I am confused about the difference between the 2 lists.
    – ethicalhacker
    Commented Jun 13, 2023 at 8:58
0

Top 10 lists' purpose is communication, to raise awareness.

If you already know about Top 10 list, other lists by OWASP do exist that are deeper in specificity. If you dig into those lists, it makes sense to subdivide security controls into an API-specific one. There are many of them that only concern APIs.

Since not every software features an API, it seemed better for the collective to make multiple list/projects. For example, there is also a list specific to mobile Applications.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .