NoName Sensor

Recently, we were asked to explore and integrate the NoName sensor on our server. This all was happening after our organisation was bombarded with cyber attack during the holiday season. So, this is what I found about NoName sensor.

Noname Security is a tool that helps protect APIs (Application Programming Interfaces) by monitoring and securing how data is sent and received through these APIs. It makes sure that only authorized users or systems can access the data and services provided by your APIs.

Authentication Methods Supported by Noname API Security

Authentication is the process of checking whether someone or something is allowed to access an API. In simpler words, it’s like checking an ID to confirm if you’re allowed into a building. Noname supports several ways to authenticate users or services before they can use your APIs. Here are the main methods:

1. API Key Authentication

• What it is: An API key is like a special password used by a system or user to access an API. It’s a unique string (like abc123xyz) that’s passed along with the request.
• How NoName helps: Noname checks if the API key is valid and hasn’t been exposed or misused (e.g., accidentally shared or stolen).

2. JWT (JSON Web Token) Authentication

• What it is: A JWT is a small, secure piece of information (token) used to prove who the user is. It’s commonly used in web apps and mobile apps. The server creates the token, and the client sends it to access the API.
• How NoName helps: Noname makes sure the JWT is valid (not tampered with), not expired, and comes from a trusted source. It ensures users can’t use fake or old tokens to access your APIs.

3. OAuth 2.0 Authentication

• What it is: OAuth 2.0 is a system that allows apps to access a user’s data without needing their password. Instead, the user gives permission, and the app gets an access token (like a temporary password).
• How NoName helps: Noname checks that the access token is valid and hasn’t expired. It also makes sure that the token grants the app the right level of access.

4. Bearer Token Authentication

• What it is: A Bearer token is like a special pass you show to get into a restricted area. It’s typically passed in the request’s Authorization header.
• How NoName helps: Noname checks the Bearer token to ensure it’s valid, hasn’t expired, and is being used correctly.

5. Basic Authentication

• What it is: Basic Authentication sends a username and password with each API request. It’s very simple but not very secure unless used over SSL (to encrypt the connection).
• How NoName helps: Noname checks if Basic Authentication is being used properly and securely, ensuring that passwords aren’t exposed.

6. Mutual TLS (mTLS) Authentication

• What it is: Mutual TLS (mTLS) is a very secure way for two systems to prove each other’s identity using certificates (like digital IDs). Both the client and the server use certificates to authenticate each other.
• How NoName helps: Noname ensures that the certificates being used in mTLS are valid, not expired, and haven’t been compromised.

Rate Limiting and Quotas

Rate Limiting and Quotas are important for ensuring your APIs are not overwhelmed by too many requests in a short period.

• Rate Limiting refers to the practice of limiting the number of API calls that can be made within a given timeframe (e.g., 100 requests per minute). This ensures fair usage and protects backend systems from being overloaded.
• Quotas refer to predefined limits on how much resource or data a client can consume, such as the number of API calls per day, month, or a certain number of gigabytes of data.

Best Practices for Rate Limiting:

• Use the X-Rate-Limit header to communicate rate limit status back to the client.
• Implement both soft and hard limits: Soft limits issue warnings before reaching the threshold, while hard limits reject requests once the threshold is reached.
• Use dynamic rate limiting to adjust based on API load, traffic patterns, or time of day.

Best Practices for Error Handling

Handling errors effectively is critical for a good user and developer experience. Here’s how you can approach error handling:

Get Vipul Kumar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Common HTTP Status Codes:

• 200 OK: Request was successful.
• 400 Bad Request: The request was malformed or missing required parameters.
• 401 Unauthorized: Authentication failed or not provided.
• 403 Forbidden: The user doesn’t have permission for the requested action.
• 404 Not Found: The requested resource doesn’t exist.
• 429 Too Many Requests: Rate limit exceeded.
• 500 Internal Server Error: Server-side error.

Noname Integration:

• Alerting on 4xx and 5xx Errors: Noname can help you set up alerts for HTTP 4xx (client errors) and 5xx (server errors) so you can respond quickly.
• Structured Error Responses: Ensure APIs return error responses in a consistent format, e.g., { "error": "message", "code": 400 }.
• Graceful Degradation: For rate limits, implement a backoff mechanism or retry logic on the client-side.

Installation

NoName can be installed on VMs using installation scripts or can be integrated in base AMI if we are planning to deploy our application on cloud (ECS or EKS).