Lion Cipher Lab
Enforce an OpenAPI contract at the edge: validate every request and response against the schema
- AppSec / DevSecOps
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Most API breaches are not clever. A client sends a field the developer never expected, such as role=admin, and the code saves it. Or an endpoint returns the whole database row, and the password hash rides along to every caller. Both bugs live in handler code that someone forgot to write carefully, and there are hundreds of handlers. An API contract written in OpenAPI turns 'what is allowed' into one document that a single piece of middleware enforces on every request and every response, so the next forgotten handler is caught at the edge instead of in an incident report. OWASP's API Security…
What you'll learn
- Writing an OpenAPI 3.1 contract whose schemas are an allow-list: types, enums, ranges, patterns, length limits, required fields and additionalProperties:false
- Building validation middleware that resolves the operation and checks path parameters, query parameters and the JSON body before any handler runs
- Validating responses on the way out so internal fields such as password_hash never leave the service, and failing closed when they try
- Enforcing readOnly yourself, because JSON Schema treats it as an annotation
- Measuring a before/after request corpus: what reaches the handler, what leaks, what gets stored
- Turning on format checking and knowing which formats your install can actually check
- Knowing exactly where schema validation stops: authorization (BOLA), output encoding, and business logic
- Pricing the contract in microseconds and deciding where response validation belongs
Steps in this lab
- What an API contract is, in plain words
- Set up a folder and install jsonschema
- Write the contract: openapi.json
- Build the enforcer: contract.py
- Build the sloppy app and watch it leak: app.py
- Turn the contract on and send the same three requests
- Measure it: 34 requests, three ways
- Where schema validation stops: the four requests that got through
- Three gotchas: format, readOnly and the dollar sign
- What it costs: latency.py
- Judgment: when to validate responses, and how a pro runs this
- Clean up and what you built