Case Study · Systems & Integrations

Securing banking APIs Strengthening business logic, authorization and sessions against misuse

Partner project by Innowise

Project profile

CustomerNot named
PartnerInnowise
IndustryBanking

Challenge

A commercial bank was confronted with fraudulent internal transfers. Critical weaknesses in the API logic made it possible to use undocumented functions. The aim was to identify the causes and to restrict unauthorized actions effectively.

Solution

A white-box review of the business logic

Innowise examined internal and external layers of the application with insight into the implementation. The focus was on hidden weaknesses and on the validation of the relevant business operations.

Combining several safeguards

Based on the findings, stricter validation rules, several authorization layers and improved session controls were added. According to the project description, the platform detects and blocks suspicious activity in real time.

Protection layers around the banking operation

Banking operation: Request → Validation: Business rules; Validation: Business rules → Authorization: Several layers; Authorization: Several layers → Session control: Authorized context; Session control: Authorized context → Execution: Permitted operation; Validation: Business rules → Reject / block: Suspicious activity; Authorization: Several layers → Reject / block: Suspicious activity; Session control: Authorized context → Reject / block: Suspicious activity.

Technologies

Java / Spring Boot
TypeScript / REST API
SonarQube / Checkmarx

Results

The rework strengthened the digital banking environment and reduced the fraud risk described. The source contains no dependable percentage figure and does not evidence that future attacks are ruled out entirely.

API logic reviewed
Validation and authorization strengthened
Session controls improved