Sécurité API 2026 : 7 priorités pour comprendre

# Données empiriques API attaques 2024-2025 (Salt Labs Q1 2024 + Akamai SOTI 2024)
prevalence_api = {
    "API1 BOLA": "40%+ des incidents, IDOR + privilege escalation",
    "API2 Broken Auth": "20% des incidents, JWT/OAuth misconfigs",
    "API3 BOPLA": "12%, mass assignment + property leakage",
    "API4 Unrestricted Resources": "10%, DoS economic + scraping",
    "API9 Improper Inventory": "8%, shadow APIs en prod",
}
# Total top 5 = ~90% des incidents documentés 2024-2025

# ANTI-PATTERN BOLA, endpoint sans authz objet-level
@app.route("/api/orders/<int:order_id>", methods=["GET"])
@require_auth                    # auth ✓
def get_order(order_id):
    return Order.get(order_id)   # PAS de check : Order.user_id == current_user.id
    # User A peut accéder à /api/orders/42 même si order 42 appartient à user B
 
# PATTERN CORRECT BOLA, authz objet-level systématique
@app.route("/api/orders/<int:order_id>", methods=["GET"])
@require_auth
def get_order(order_id):
    order = Order.get(order_id)
    if not order:
        abort(404)
    # CRITIQUE : check ownership ou autorisation explicite
    if order.user_id != g.current_user.id and not g.current_user.has_role("admin"):
        # Retourner 404 plutôt que 403 pour ne pas fuir l'existence de l'objet
        abort(404)
    return order
 
# ANTI-PATTERN BFLA, endpoint admin sans check role
@app.route("/api/users/<int:user_id>", methods=["DELETE"])
@require_auth
def delete_user(user_id):
    User.delete(user_id)  # PAS de check role admin
 
# PATTERN CORRECT BFLA
@app.route("/api/users/<int:user_id>", methods=["DELETE"])
@require_role("admin", "superadmin")  # Décorateur qui valide le role
def delete_user(user_id):
    if user_id == g.current_user.id and g.current_user.role == "superadmin":
        abort(403, "cannot self-delete superadmin")
    User.delete(user_id)

# ANTI-PATTERN BOPLA, mass assignment user input → DB
@app.route("/api/users/me", methods=["PATCH"])
@require_auth
def update_me():
    data = request.json
    User.update(g.current_user.id, **data)
    # User envoie { "email": "x@y.com", "is_admin": true } → escalade !
 
# PATTERN CORRECT BOPLA, DTO whitelist + Pydantic validation
from pydantic import BaseModel
 
class UserUpdateInput(BaseModel):
    # Schéma explicite : seuls ces champs sont acceptés
    email: EmailStr
    display_name: str = Field(..., max_length=64)
    bio: str = Field(default="", max_length=500)
    # is_admin volontairement ABSENT, pas modifiable via cette route
 
@app.route("/api/users/me", methods=["PATCH"])
@require_auth
def update_me():
    payload = UserUpdateInput.model_validate(request.json)
    User.update(g.current_user.id, payload.model_dump(exclude_unset=True))
 
# ANTI-PATTERN property leakage, sérialisation entière de l'objet User
@app.route("/api/users/<int:user_id>", methods=["GET"])
def get_user(user_id):
    user = User.get(user_id)
    return user.to_dict()  # Inclut password_hash, mfa_secret, internal_notes !
 
# PATTERN CORRECT, DTO de réponse explicite
class UserPublicResponse(BaseModel):
    id: int
    display_name: str
    bio: str
    avatar_url: str | None
    # NE PAS inclure : email, password_hash, mfa_secret, internal_notes
 
@app.route("/api/users/<int:user_id>", methods=["GET"])
def get_user(user_id):
    user = User.get(user_id)
    return UserPublicResponse.model_validate(user).model_dump()

# Exemple OAuth 2.1 + PKCE flow (ce que tu dois faire en 2026)
# 1. Client génère code_verifier (random 43-128 chars) + code_challenge = SHA256(verifier)
# 2. Authorization request avec :
#    - response_type=code (PAS implicit, deprecated OAuth 2.1)
#    - code_challenge_method=S256
#    - code_challenge=<hash>
#    - state=<random anti-CSRF>
#    - PKCE obligatoire (même pour clients confidentiels en 2.1)
 
# 3. Token endpoint exchange :
POST /oauth/token
Content-Type: application/x-www-form-urlencoded
 
grant_type=authorization_code
&code=<auth_code>
&code_verifier=<verifier>
&client_id=<client_id>
&redirect_uri=<exact_match>
 
# 4. Response :
{
  "access_token": "<JWT short-lived>",
  "expires_in": 900,                        # 15 min recommandé
  "refresh_token": "<opaque rotated>",      # rotation à chaque use
  "token_type": "Bearer",
  "id_token": "<si OIDC>"
}

# Validation JWT correcte 2026 (avec PyJWT)
import jwt
from cryptography.hazmat.primitives.serialization import load_pem_public_key
 
with open("public_key.pem") as f:
    public_key = load_pem_public_key(f.read().encode())
 
try:
    payload = jwt.decode(
        token,
        public_key,
        algorithms=["RS256", "ES256"],         # JAMAIS d'option "none"
        audience="api.example.com",            # CRITIQUE : valider aud
        issuer="https://auth.example.com",     # CRITIQUE : valider iss
        options={
            "require": ["exp", "iat", "iss", "aud", "sub"],
            "verify_exp": True,
            "verify_iat": True,
            "verify_aud": True,
            "verify_iss": True,
        }
    )
except jwt.ExpiredSignatureError:
    abort(401, "token expired")
except jwt.InvalidTokenError as e:
    # Pas de log du token complet (secret), juste l'erreur
    logger.warning("invalid_jwt", extra={"error_type": type(e).__name__})
    abort(401, "invalid token")

// Configuration GraphQL sécurisée 2026 (Apollo Server / GraphQL Yoga)
const { ApolloServer } = require('@apollo/server');
const depthLimit = require('graphql-depth-limit');
const costAnalysis = require('graphql-cost-analysis').default;
 
const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: process.env.NODE_ENV !== 'production',  // OFF en prod
  formatError: (err) => {
    // Pas de stacktrace en prod
    if (process.env.NODE_ENV === 'production') {
      return { message: err.message };  // Pas de extensions, path détaillé
    }
    return err;
  },
  validationRules: [
    depthLimit(8),                                       // max 8 nested levels
    costAnalysis({
      maximumCost: 1000,
      defaultCost: 1,
      variables: {},
      onComplete: (cost) => {
        if (cost > 500) logger.warn('expensive_query', { cost });
      },
    }),
  ],
  // Disable batched queries en prod si non nécessaires
  allowBatchedHttpRequests: false,
});

# Stack OSS API security 2026 minimum (équipe < 50 dev, ~0 € budget)
 
# === SAST API spec ===
brew install spectral                            # Lint OpenAPI/Swagger
spectral lint openapi.yaml                       # Détecte problèmes spec
 
# === DAST + fuzzing ===
brew install zap                                 # OWASP ZAP avec OpenAPI import
docker run --rm -v $(pwd):/zap/wrk owasp/zap2docker-stable \
  zap-api-scan.py -t /zap/wrk/openapi.yaml -f openapi -r api-report.html
 
# === Fuzzing API spec-driven ===
pip install schemathesis                         # Property-based testing OpenAPI
schemathesis run openapi.yaml --base-url https://api.example.com --hypothesis-deadline=10000
 
# === Templates Nuclei API ===
brew install nuclei
nuclei -u https://api.example.com -t exposures/apis/ -t vulnerabilities/
 
# === Microsoft RESTler (Microsoft Research) ===
git clone https://github.com/microsoft/restler-fuzzer
# Fuzz stateful basé sur OpenAPI
 
# === API Gateway runtime ===
helm install kong kong/kong                      # Open source, plugins nombreux
# Alternatives : Tyk (OSS), AWS API Gateway, Kubernetes Gateway API
 
# === Service mesh mTLS ===
istioctl install --set profile=demo              # Istio 2026
# Alternatives : Linkerd, Cilium Service Mesh
 
# === GraphQL specifics ===
# InQL (Burp Suite extension), GraphQL pentest
# Clairvoyance (introspection bypass)
git clone https://github.com/nikitastupin/clairvoyance
python3 -m clairvoyance -u https://api.example.com/graphql -o schema.json
 
# === API Discovery / Inventory ===
# Apicurio Registry (OSS), registry OpenAPI
# Salt Security, Noname Security, 42Crunch (commerciaux pour scale-ups+)