Security engineering6 MIN READ
Authorisation, not authentication, is where API breaches begin
Most APIs authenticate well and authorise badly. The defects that matter are object-level and function-level access rules scattered across handlers, where no single reviewer can see the whole rule.