API Security
API Security has become a popular topic recently. The reason is simple, with growth in microservices, cloud infrastructure, Internet of Things, and multi-platform applications, the use of APIs has grown exponentially in the last decade. True to form in this industry, hackers are looking to exploit these systems. An article from Data Center Knowledge described that only 6% of companies had no API-related security issues in 2021. If questions arise of how reliable the research is, do note that companies like Microsoft, American Airlines, J.B. Hunt were some of the companies recorded to have a security breach.
So how do we secure our APIs? Is it possible to be secure? The answer to the previous question is obviously no. Where access is given, there lies a vulnerability.
To secure their APIs, what steps can be taken to ensure your application is secure?
First of all, note that:
Security is not a one-time deal. You will need to adjust your security according to requirements for your apps, technologies used, user ecosystem, and many more parameters.
Take a holistic view of security. Do not focus on just one module as security. Rather security should be a part of every single line of code your API contains.
Get Damilola Nwankpele’s stories in your inbox
Join Medium for free to get updates from this writer.
So what are the areas that we can generally focus on when working on security?
- Authorization: Ensure the person using the API has the right to do what he is doing. Ensure all API endpoints confirm that the client making the request is allowed. OAuth JWT tokens and 2 Factor Authentication is the preferred choice, but security is not a one size fits all solution. Look at your business and decide what is best for it.
- Authentication: Ensure that the person consuming your API is who they say they are. The best way to do this is through Open ID connect. Open ID is just an extension of OAuth 2.0 used for authorization. An example showing the consequence, of lack of adequate authentication methods is the security breach on the Microsoft Exchange Server targeted by Chinese-sponsored hackers.
- Only show what is required: Plenty developers succumb to being lazy coders. They can return an entire model without ensuring that all resources returned are strictly required. To give more than what is needed leads to exposure of data. So when releasing data, release what is needed, nothing more, nothing less. An article on wired explains how 3m million records were exposed because private data was public.
- Rate or Page Limiting: Ever heard of pagination? It has security benefits. Limiting the number of resources a client can request can prevent brute force attacks and DOS (Denial of Service) attacks. Not to mention it is better on the server. John Deere developed an API to extend their successful business, producing farm equipment, into IoT (Internet of Things). The API quality was poor, you could make calls without security checks, and there was no rate limiting checks. Please don’t succumb to writing just enough code.
- Input checks: Whatever is entering your server must go through significant and thorough checks and validation. Imagine allowing file inputs without running proper type validation. A hacker can run an executable file on your server, enslaving your system. Ensure that there are security validations for all forms of inputs on your server. Freepik and Flaticon fell to SQL injection attacks on the Flaticon website. Proper input checks can protect your API from injection attacks other types of attacks.
- Security configuration. Make sure your underlying security system is proper. A lot of times hackers can take advantage of how your security system is configured. How you manage several types of attack, error messages are just among a few. Set up a good process to handle threats and errors.
- Hierarchy: Make sure you maintain proper levels of access. Not everyone should be allowed to see and do the same thing. Have a proper hierarchy for access and ensure the users are well differentiated.
- Logging and monitoring: This point is important. TO make your system secure, you need to monitor for threats and vulnerabilities. Set up a logging and monitoring system to keep track of the errors and possible vulnerabilities and threats being faced. A Microsoft API was hacked, but they could report it and trace the issue. Most major tech companies fall under this category, so using a proper logging system and monitoring system is always going to be of benefit in the long term
If possible, try to avoid API keys as a security measure. They are not secure.
Also, make sure all individuals associated with the development and management of the API are security conscious because social engineering is still a favored method of gaining access.
Finally, while designing your API, imagine the developers consuming the API are not security conscious. IF they are not, that means data security falls on you as the API developer and just you.
Happy coding everyone
