In all answers I gave in StackOverflow I normally end-up the answer with some links to the OWASP material:
Do You Want To Go The Extra Mile?
In any response to a security question I always like to reference the excellent work from the OWASP foundation.
For APIS
The OWASP API Security Project seeks to provide value to software developers and security assessors by underscoring the potential risks in insecure APIs, and illustrating how these risks may be mitigated. In order to facilitate this goal, the OWASP API Security Project will create and maintain a Top 10 API Security Risks document, as well as a documentation portal for best practices when creating or assessing APIs.
For Mobile Apps
OWASP Mobile Security Project - Top 10 risks
The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. Through the project, our goal is to classify mobile security risks and provide developmental controls to reduce their impact or likelihood of exploitation.
OWASP - Mobile Security Testing Guide:
The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security development, testing and reverse engineering.
For Web Apps
The Web Security Testing Guide:
The OWASP Web Security Testing Guide includes a “best practice” penetration testing framework which users can implement in their own organizations and a “low level” penetration testing guide that describes techniques for testing most common web application and web service security issues.
Now, if your app takes in account all OWASP top ten risks you are only protecting it from being exploited through vulnerabilities, but you are not protecting it from being exploited through impersonation or if you prefer spoofed requests. My CEO makes these points in this video and article on the context of a mobile API, but the main points are still valid for any API. I need to do a disclaimer, the video contains a pitch to our product, but I think its still useful to better help you understand why it’s important that you go behind OWASP TOP 10 to ensure that your API is not exploitable via spoofed requests, aka to identify that the request is indeed from what you expect, your original and untampered app.
You can also read more about protecting APIs in the several answers I gave in StackOverflow, like:
