> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/common-api-security-problems.md).

# Common API Security Problems

Common API security problems include:

* **Broken Authentication**: Weaknesses in the authentication mechanisms that allow attackers to compromise passwords, keys, or session tokens.
* **Excessive Data Exposure**: APIs that expose more data than necessary, potentially leaking sensitive information.
* **Lack of Resources & Rate Limiting**: APIs that do not implement proper rate limiting, making them vulnerable to denial-of-service (DoS) attacks.
* **Broken Function Level Authorization**: Similar to BOLA, but at the function level, where attackers can access functions they shouldn't.
* **Unsafe Consumption of APIs**: APIs that are not properly secured can be misused by clients, leading to various security issues.