OpenAPI as a security tool, not just documentation

Philippe De Ryck
Philippe De Ryck
Security Expert, Pragmatic Web Security
Abstract

OpenAPI specifications are more than just documentation—they can be a powerful foundation for improving your application's security. This talk explores how to effectively use OpenAPI in both code-first and spec-first workflows. We’ll discuss how well-crafted specs help uncover security issues, guide audits, and power security tools for testing, automated attacks, and even runtime protection. You’ll walk away with practical insights into turning your API specs into a security asset, not just a developer convenience.

00:00:00 Introduction to OpenAPI and Swagger

00:01:20 OpenAPI as developer documentation

00:03:03 How OpenAPI contracts describe an API

00:05:00 Demo: augmenting generated OpenAPI specs

00:08:09 Using specs for security testing

00:10:36 Demo: running an API fuzzer

00:14:24 Auditing OpenAPI specs for security

00:21:36 Defining error codes and authentication

00:26:38 OpenAPI and API security vulnerabilities

00:32:00 Demo: finding excessive data exposure

00:37:15 Mass assignment explained

00:43:41 Moving from code-first to API-first

00:51:03 Preventing drift with conformance scanning

00:53:12 Runtime enforcement with API contracts

00:59:25 Final recommendations and takeaways