API Gateway Config Lab
A gateway is only as good as its config. Set up a simulated gateway for a fictional company: JWT checks (issuer, audience, algorithm allow-list), API keys and mTLS per route, allowed methods, body limits, schema validation, rate limits and quotas, IP allow-lists for admin routes, CORS origins, header rules and error verbosity. Then replay the traffic: real users and partners mixed with alg:none tokens, credential stuffing, verb tampering, X-User-Id spoofing and more. See which rule decided each request, tune, replay fresh traffic, and get a debrief mapped to the OWASP API Security Top 10 2023.
Runs in your browser. Synthetic traffic only; nothing is sent anywhere. Free, including the JSON export.
TL;DRWhat this lab is
5 points
- You configure a simulated API gateway for a fictional company: per-route auth (JWT, API key, mTLS), allowed methods, body limits, schema validation, per-route and per-consumer rate limits and quotas, IP allow-lists, CORS origins, header rules and error verbosity.
- Then you replay 42 to 58 seeded requests that mix real customers, partners, internal services and staff with attacks: alg:none and expired tokens, wrong audience, CORS abuse, oversized payloads, credential stuffing, admin calls from the internet, verb tampering, X-User-Id spoofing and stack-trace leaks.
- Every request shows whether it was allowed, blocked or neutralised, which rule decided it, and whether that was the right call.
- Rounds: configure, replay, tune, final replay on fresh traffic from the same seed, debrief. Your score is attacks stopped × legitimate requests served, so blocking everything scores zero.
- The debrief maps every attack to the OWASP API Security Top 10 2023 (API2, API4, API5, API8). The lab and the JSON export of your final config are free.
Why both sides are scored
Any gateway can stop every attack by refusing every request. Real configs fail the other way: a body limit set below the largest real upload, a rate limit under the busiest real integration, an allow-list that forgets the staff VPN, header stripping that also removes the user context an internal service forwards on purpose. Those false positives get gateways switched off. So the score multiplies the attack stop rate by the legitimate serve rate, and each blocked real request tells you which setting broke it.
What a gateway can and cannot fix
A gateway is the right place for authentication checks, method and size limits, rate limits, CORS, header hygiene and generic errors. It cannot tell whether user A may read order 123: that is object-level authorisation (API1), which belongs in the service. Write it into your standard with the API Security Policy Builder, go deeper on token validation in the JWT Attack & Defense Lab, and size limits from real traffic with the API Rate Limit Tuner.
Frequently asked questions
What is the API Gateway Config Lab?
A browser-based exercise where you configure a generic, vendor-neutral API gateway for a fictional company and then replay a seeded stream of traffic through it. The stream mixes legitimate users, partners, internal services and staff with common API attacks. For each request you see whether the gateway allowed, blocked or neutralised it, which rule decided, and whether that was correct.
How is the lab scored?
On the final replay, the score is the share of attacks stopped multiplied by the share of legitimate requests served. A config that blocks everything stops every attack but serves no one, so it scores zero; so does one that allows everything. Clear 75% to pass. Difficulty and speed then feed the shared PlayCISO grade from S to D.
Which attacks are in the replay?
An alg:none JWT, an expired token, a token for another API (wrong audience), CORS abuse from a lookalike origin, an oversized payload, a credential-stuffing burst, an admin route called from the internet with a phished token, verb tampering, an internal X-User-Id header spoof, and a malformed body that makes the backend throw a stack trace. Pro and Elite add scraping with a stolen token, an internal route called without a client certificate, a MIME-sniffed upload, HS256 algorithm confusion, a foreign issuer, Origin: null, a huge array inside the size limit and a leaked partner key draining its quota.
How do the attacks map to the OWASP API Security Top 10 2023?
Token, credential-stuffing, header-spoof and missing-mTLS attacks map to API2:2023 Broken Authentication. Oversized payloads, huge arrays, scraping and quota drain map to API4:2023 Unrestricted Resource Consumption. Admin routes from the internet and verb tampering map to API5:2023 Broken Function Level Authorization. CORS abuse, verbose errors and missing security headers map to API8:2023 Security Misconfiguration.
What are the three difficulty levels?
Rookie starts from a permissive config with a full briefing. Pro adds a carrier API, an internal billing service over mTLS, document downloads and tighter real traffic. Elite starts from a config that is too loose in some places and too tight in others, and the briefing leaves out some real clients (a VPN range, ES256 mobile tokens, a partner portal origin, larger uploads) that you only discover in the round 1 replay.
Is it free, and does it send any traffic?
The lab is free, including the JSON export of your final config. Nothing leaves your browser: the companies, tokens and requests are synthetic, domains are .example and public addresses come from the RFC 5737 documentation ranges. The exported JSON is a generic training config to adapt, not a file for a specific gateway product.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.