thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Unsafe Consumption of APIs

API10:2023, trusting data from third-party APIs more than user input, leading to injection, redirects or data exposure.

Definition

Developers often skip validation of responses from integrated services. Mitigations include validating and sanitizing third-party data, using TLS, allowlisting redirect destinations, setting timeouts and assessing provider security.

Example

An app inserts an address returned by a partner API directly into a SQL query.

Exam tip

Treat third-party API responses as untrusted input.

Related terms