kras99 - stock.adobe.com
8 best practices for securing RESTful APIs
The REST architectural style helps applications communicate with each other. Be sure RESTful APIs have the protections necessary to keep attackers at bay.
Web app developers often use REST APIs to bridge the gap between the database and the front of the application, which interacts with the end user. While RESTful APIs provide critical functionality, their popularity and power also make them a favorite target for bad actors.
The key to protecting RESTful APIs is to keep the security simple. Do not get caught up in thinking that more is better, as this only increases the attack surface for cyber criminals to exploit.
What is a REST API?
REST APIs use the REST, or REpresentational State Transfer, architectural style to enable communication between application types.
Developers use REST to create and deploy web applications. REST can be customized to establish the criteria for how information and data should be stored and transmitted to the end user.
Four methods are associated with the RESTful API:
- GET: This specifies how resources should be made accessible to the end user.
- POST: This describes how information an end user submits -- for example, via a website's "Contact Us" page -- should be sent to the database.
- PUT: This updates the information that currently resides in the records of the database. For instance, this functionality would allow a customer to add a new payment method to a credit card portal.
- DELETE: This erases records in the database. When a customer submits a payment, for example, but then goes back and cancels it, doing so would invoke the delete functionality.
Best practices in RESTful API security
An attacker who breaks through just one RESTful API can exfiltrate a lot of data. But there are ways to mitigate this risk, including the use of the following:
- TLS. Transport Layer Security encrypts the flow of data from the front end to the back end of a web application, and vice versa. It can also protect other mechanisms, such as API keys. The mutual TLS (mTLS) allows for the front end and the back end to authenticate each other, thus providing an extra layer of protection.
- Authorization and authentication. Authorization confirms the identity of the person trying to access the RESTful API, while authentication assigns certain rights and permissions as to what actions that person can take. The authentication step should be taken in accordance with the principle of least privilege. Mechanisms for authorization and authentication include API keys, 0Auth 2.0, which creates short-lived access tokens, and JSON Web Tokens, which are digitally signed.
- Input validation. This confirms that the data submitted by the end user is real and authentic. Without this kind of checking, a hacker can easily insert malformed information. This can lead to SQL injection or cross site scripting (XSS) attacks. To validate inputs, be sure to account for permutations, such as length and format of the content.
- Error logging. Keep a log file of errors as they occur. Whenever an API cannot complete a request, the end user sees an error message, such as: Error 400: Bad Request, Error 401: Unauthorized or Error 500: Internal Server Error. Keep these error messages simple; revealing excessive information provides an advantage to someone trying to crack your APIs.
- Controlling the number of requests. Controlling requests, which is also referred to as throttling and rate limiting, restricts the total number of requests that can be placed upon any individual API. Doing so can interrupt distributed denial of service (DDoS) attacks on the server hosting the application.
- Vulnerability checks. One of the best ways to examine APIs for weaknesses or gaps is through a penetration test. When a red team tries to break into an organization's APIs, it can detail the vulnerabilities it finds and suggest remediations.
- API discovery. With this method, an organization inventories all the APIs in use, almost as if it is conducting an audit. This is an effective way to make sure there are no rogue or malicious APIs present.
- API gateways. This kind of mechanism acts as a pivotal point to filter and process all API requests. API gateways boost security by providing additional benefits, including:
-
- Security policy. This enables a security team to implement authentication, authorization, encryption and access control protocols.
- Routing policy. This enables permutations to optimize the flow of API requests.
- Observability policy. This policy enables a team to create logs of all API transactions, which makes it possible to detect any patterns that deviate from the baseline.
Ravi Das is a technical engineering writer for an IT services provider. He is also a cybersecurity consultant at his private practice, ML Tech, Inc., and has the Certified in Cybersecurity (CC) certification from ISC2.
