APIs (application programming interfaces) provide a way for app developers to \u201ccall\u201d information from outside sources into an application they build.<\/p>\n\n\n\n
First steps for a secure REST API.<\/h2>\n\n\n\n\n\n![\"API](\"https:\/\/apimike.com\/wp-content\/uploads\/2022\/08\/toolbox.png\")
<\/figure>\n<\/div>\n\n\n\n\nUSING THE RIGHT API TOOL FROM THE TOOLBOX<\/h3>\n\n\n\n
????Always consider a CI\/CD solution as your first steps for a more secure REST API, one of the common solutions is BLST Security Cherrybomb<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\nFirst of all RESTful APIs must be stateless \u2013 so request authentication\/authorization should not depend on sessions.<\/p>\n\n\n\n
Stateless in software means that it does not keep track of configuration settings, transaction information or any other data for the next session.<\/p>\n\n\n\n
There are multiple ways to secure a RESTful API e.g. basic auth, OAuth, etc.<\/p>\n\n\n\n
Each API request should come with some sort of authentication credentials that must be validated on the server for every request.<\/p>\n\n\n\n
There are two types of api, public API and private API two of them do not require the same level of attentiveness.<\/p>\n\n\n\n
Public APi:<\/strong><\/p>\n\n\n\n As the name indicates, public API allows the resources to be public to the internet.<\/p>\n\n\n\n
For example \/prices or \/product are resources available in your website for users without authentication. <\/p>\n\n\n\n
Even though the resource is public I strongly recommend using an API key (API Key is a single token string) to limit the chance of abuse.<\/p>\n\n\n\n
Private API:<\/strong><\/p>\n\n\n\nAn internal (or private) API is intended only for use within the company, to connect systems and data within the business. Internal API can provide information about users on the platform and that data has to be accessible only to the owners.<\/p>\n\n\n\n
Fu<\/strong>ndamentals for a secure REST API the AAA:<\/h2>\n\n\n\n Authentication.<\/strong><\/p>\n\n\n\nAuthentication is used to know who called the endpoint of the Rest api.<\/p>\n\n\n\n
Authentication proves that you are who you say you are.<\/p>\n\n\n\n
Authorization<\/p>\n\n\n\n
Authorization occurs after the user authenticates himself, authorization deals with which resources are permitted to be used by the caller.<\/p>\n\n\n\n
Since each HTTP call is handled independently, each time your application receives a call, you will need to decide whether or not the caller is allowed to consume that particular resource.<\/p>\n\n\n\n
Accountability.<\/p>\n\n\n\n
Accountability (also traceability) is about who did what, when and with what resources.<\/p>\n\n\n\n
To accurately track what is happening in your system, you need to note each HTTP call the 3 W\u2019s, what, who and when:<\/p>\n\n\n\n
\n- What\n
\n- The used resource<\/li>\n\n\n\n
- The method used <\/li>\n\n\n\n
- The code response<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Who\n
\n- Who request the endpoint, and what is the permission<\/li>\n\n\n\n
- Which app call the api <\/li>\n<\/ul>\n<\/li>\n\n\n\n
- When\n
\n- When occurs the request<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p>\n\n\n\n
Common ways to robust your REST API security<\/h2>\n\n\n\n\n- The use of tokens, establish trusted identities and then control access to services and resources by using tokens<\/a> assigned to those identities. <\/li>\n\n\n\n
- Least Privilege: An entity should only have the required set of permissions to perform the actions for which they are authorized, and no more. <\/li>\n\n\n\n
- Use encryption . Always use HTTPS, encrypt your data using a method like TLS(see above). <\/li>\n\n\n\n
- Use a signature. Passwords must always be hashed in order to protect your organization. Using signatures helps to ensure that the right users are decrypting and modifying your data, and no one else.<\/li>\n\n\n\n
- Keep it simple. Try to keep your API simple as possible, to avoid miscomprehension and ensure a good implementation of security<\/li>\n\n\n\n
- Input Parameter Validation. Put strong validation checks and reject the request immediately if validation fails. Validate request parameters on the very first step, before it reaches application logic. In API response, send relevant error messages and examples of correct input format to improve user experience. Check every parameter request before it reaches the application logic.<\/li>\n\n\n\n
- Identify vulnerabilities. Keep up with your operating system, network, drivers, and API components. Know how everything works together and identify weak spots that could be used to break into your APIs. <\/li>\n\n\n\n
- Use quotas and rate limiting. Place quotas on how often your API can be called and track its use over history. More calls on an API may indicate that it is being abused. It could also be a programming mistake such as calling the API in an endless loop. Make rules for throttling to protect your APIs from spikes and Denial-of-Service attacks.<\/li>\n\n\n\n
- Use an API gateway. API gateways<\/a> act as the major point of enforcement for API traffic. A good gateway will allow you to authenticate traffic as well as control and analyze how your APIs are used.<\/li>\n\n\n\n
- Integrate Dynamic Application Security Testing (DAST), they detect vulnerabilities by performing actual attacks, similar to a real hacker. In a sense, DAST tools perform automated penetration testing of your web applications.<\/li>\n\n\n\n
- Use a WAF. Integrate a web application firewall for detecting malicious payload<\/li>\n<\/ul>\n\n\n\n
In conclusion it is important to understand that API is a new battlefield that brings new ways of abuse that are thought about each and every day. <\/p>\n\n\n\n
Using the methods listed in this article to secure your REST API will surely give you a layer of protection against a few types of attacks but overall it is recommended a consultation with one of the many API Security companies, some of the methods are more advanced than others for example DAST is far more advanced tgab<\/p>\n","protected":false},"excerpt":{"rendered":"
Your API successfully interacts between your microservices and then a fear rises and you confront your colleagues and superiors with the dilemma of \u201cAt the end I expose my application on the web which means my data will not be safe!\u201d.<\/p>\n","protected":false},"author":3,"featured_media":320,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"_links":{"self":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts\/315"}],"collection":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/comments?post=315"}],"version-history":[{"count":1,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts\/315\/revisions"}],"predecessor-version":[{"id":2376,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts\/315\/revisions\/2376"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/media\/320"}],"wp:attachment":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/media?parent=315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/categories?post=315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/tags?post=315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/figure>\n<\/div>\n\n\n\nUSING THE RIGHT API TOOL FROM THE TOOLBOX<\/h3>\n\n\n\n
????Always consider a CI\/CD solution as your first steps for a more secure REST API, one of the common solutions is BLST Security Cherrybomb<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n First of all RESTful APIs must be stateless \u2013 so request authentication\/authorization should not depend on sessions.<\/p>\n\n\n\n Stateless in software means that it does not keep track of configuration settings, transaction information or any other data for the next session.<\/p>\n\n\n\n There are multiple ways to secure a RESTful API e.g. basic auth, OAuth, etc.<\/p>\n\n\n\n Each API request should come with some sort of authentication credentials that must be validated on the server for every request.<\/p>\n\n\n\n There are two types of api, public API and private API two of them do not require the same level of attentiveness.<\/p>\n\n\n\n Public APi:<\/strong><\/p>\n\n\n\n As the name indicates, public API allows the resources to be public to the internet.<\/p>\n\n\n\n For example \/prices or \/product are resources available in your website for users without authentication. <\/p>\n\n\n\n Even though the resource is public I strongly recommend using an API key (API Key is a single token string) to limit the chance of abuse.<\/p>\n\n\n\n Private API:<\/strong><\/p>\n\n\n\n An internal (or private) API is intended only for use within the company, to connect systems and data within the business. Internal API can provide information about users on the platform and that data has to be accessible only to the owners.<\/p>\n\n\n\n Authentication.<\/strong><\/p>\n\n\n\n Authentication is used to know who called the endpoint of the Rest api.<\/p>\n\n\n\n Authentication proves that you are who you say you are.<\/p>\n\n\n\n Authorization<\/p>\n\n\n\n Authorization occurs after the user authenticates himself, authorization deals with which resources are permitted to be used by the caller.<\/p>\n\n\n\n Since each HTTP call is handled independently, each time your application receives a call, you will need to decide whether or not the caller is allowed to consume that particular resource.<\/p>\n\n\n\n Accountability.<\/p>\n\n\n\n Accountability (also traceability) is about who did what, when and with what resources.<\/p>\n\n\n\n To accurately track what is happening in your system, you need to note each HTTP call the 3 W\u2019s, what, who and when:<\/p>\n\n\n\n <\/p>\n\n\n\n In conclusion it is important to understand that API is a new battlefield that brings new ways of abuse that are thought about each and every day. <\/p>\n\n\n\n Using the methods listed in this article to secure your REST API will surely give you a layer of protection against a few types of attacks but overall it is recommended a consultation with one of the many API Security companies, some of the methods are more advanced than others for example DAST is far more advanced tgab<\/p>\n","protected":false},"excerpt":{"rendered":" Your API successfully interacts between your microservices and then a fear rises and you confront your colleagues and superiors with the dilemma of \u201cAt the end I expose my application on the web which means my data will not be safe!\u201d.<\/p>\n","protected":false},"author":3,"featured_media":320,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"_links":{"self":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts\/315"}],"collection":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/comments?post=315"}],"version-history":[{"count":1,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts\/315\/revisions"}],"predecessor-version":[{"id":2376,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/posts\/315\/revisions\/2376"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/media\/320"}],"wp:attachment":[{"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/media?parent=315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/categories?post=315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/apimike.com\/wp-json\/wp\/v2\/tags?post=315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Fu<\/strong>ndamentals for a secure REST API the AAA:<\/h2>\n\n\n\n
\n
\n
\n
\n
Common ways to robust your REST API security<\/h2>\n\n\n\n
\n