Some of the web services are released with standard REST or SOAP APIs. The key difference between web and API security testing is the browser UI dependency. In API testing, we will only focus on the request and response instead of the UI layout or presentation.
It is always recommended to use the API testing approach because web UI testing can provide unreliable testing results. General API security testing may cover authentication, authorization, input validation, error handling, data protection, secure transmission, and HTTP header security.
The case we will discuss here concerns a development manager who would like to build an API security testing framework for every release. However, he may encounter the following challenges when he is trying to build the API security testing framework, especially for a development team without...