API Security on API Course

Cloudflare Used AI to Attack Its Own WAF and Found 49 Gaps, Mostly SSRF

Wed, 07 Oct 2026 00:00:00 +0000

Cloudflare just published the results of an experiment that every API developer should read, even if you’ll never run a firewall. The company put frontier AI models inside a test harness and told them to get past its own Web Application Firewall.

They found gaps. Not many, but the pattern of what got through is the real lesson.

What Cloudflare did

The test started with attack payloads the WAF already blocked. Instead of replaying a fixed list, the models looked at how each attempt was handled and proposed a tweak for the next one: different encoding, different placement in the request, different delivery. They had no access to the WAF rules or source code. Pure black box.

API Authentication: API Keys, OAuth 2.0, and JWT Explained

Sat, 02 May 2026 00:00:00 +0000

Authentication is where most API integrations go wrong the first time. Not because the concepts are complicated, but because there are several distinct mechanisms in common use, they solve different problems, and developers often reach for the one they recognize rather than the one that fits. Understanding what each mechanism actually does — and what it does not do — is the difference between an integration that works and one that works until it doesn’t.

API Security Fundamentals: What Every Developer Needs to Know

Sat, 02 May 2026 00:00:00 +0000

API security failures are not exotic. They rarely involve sophisticated attacks on cryptographic primitives or novel zero-day exploits. The most consequential breaches — the ones that expose millions of records, compromise user accounts, or shut down services — happen because an API allowed something it should not have, at a scale its designers did not anticipate. Understanding the fundamental attack surface of an API and designing against it deliberately is the entire discipline. It is not advanced knowledge. It is the baseline.

CORS Explained: Why Browsers Block API Requests and How to Fix It

Sat, 02 May 2026 00:00:00 +0000

CORS is the source of more developer frustration than almost any other browser security mechanism — not because it is poorly designed, but because its error messages are opaque, its rules are non-obvious, and it only manifests in a specific context that server-side developers often do not encounter during development. Understanding what CORS actually is and why it exists transforms it from an arbitrary obstacle into a predictable system with clear rules.

Multi-Tenancy in APIs: Data Isolation, Routing, and Tenant Context

Sat, 02 May 2026 00:00:00 +0000

Most SaaS APIs are multi-tenant: the same infrastructure serves many customers, each operating in isolation from the others. A user of Tenant A should never see, modify, or even know about the data of Tenant B. This isolation is the foundational guarantee of a multi-tenant system, and it must hold at every layer of the stack — not just at the query level, but at the API design level, the authentication level, and the operational level.