DEVELOPING A REST AND GRPC API SECURITY TESTING FRAMEWORK BASED ON OWASP STANDARDS

Abstract

REST and gRPC application programming interfaces expose different interface, transport, state and message models, which complicates unified security assessment. This review-based design study examines standards and automated testing techniques for specification-based test generation, stateful fuzzing, authorization testing, resource-consumption testing and continuous assessment, and on that basis proposes an OWASP-aligned security testing framework covering both protocols. Eight families of existing approaches were classified along nine dimensions using a targeted corpus of primary sources. The review shows that current tools provide effective individual components, including dependency inference, model feedback, search-based generation and vulnerability-specific oracles, but that these components remain fragmented across protocols and testing objectives. The proposed framework combines interface discovery, OpenAPI and protocol-buffer parsing, identity management, risk mapping, stateful test generation, fuzzing, specialized security oracles, evidence-based reporting and continuous delivery integration. Its principal methodological contribution is that the security oracle of every covered OWASP risk family receives an explicit logical predicate over identities, objects, responses and persistent state, while streaming obligations are expressed in linear temporal logic, so that a finding is defined by a mechanically checkable condition rather than by an informal description. Test state is modelled as the product of an operation dependency graph, a per-resource lifecycle automaton and the normative HTTP/2 stream automaton, closed under a provenance environment recording the identity and timestamp of every harvested identifier. An evaluation protocol based on paired vulnerable and patched services, seeded ground truth, baseline tools and nine metrics is also defined. The results are conceptual and specification results: the practical effectiveness of the framework is not evaluated here and is deferred to a separate experimental study.