---
title: "Discussion on \"API Auth Bugs Are Usually State Bugs\" | Hashnode"
description: "Discussion on \"API Auth Bugs Are Usually State Bugs\". Most API authorization bugs get described as a missing check, as if someone forgot an if statement. They are almost never that."
url: "https://hashnode.com/posts/api-auth-bugs-are-usually-state-bugs/6ace5f32c7aa0a2a88f98717"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [API Auth Bugs Are Usually State Bugs](https://harrisonsec.hashnode.dev/api-auth-bugs-are-usually-state-bugs?utm_source=hashnode&utm_medium=feed)

Most API authorization bugs get described as a missing check, as if someone forgot an if statement. They are almost never that.

Oct 13 · 9 min read · harrisonsec.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#api](https://hashnode.com/tag/api)
-   [#web-development](https://hashnode.com/tag/web-development)

## Written by

[Harrison Guo](https://hashnode.com/@harrisonguo)

@harrisonguo · WhiteRock, CA

  
[View profile](https://hashnode.com/@harrisonguo)

Security engineer and distributed systems practitioner. Writing about systems internals, performance, security research, and AI applications. Building harrisonsec.com.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.