Seven Best Practices for Securing APIs

Summary

A tutorial outlines seven API security practices: authentication, authorization, rate limiting, input validation, monitoring, replay-attack protection, and API discovery to identify unprotected endpoints.

Key points

• Use authentication to verify a user's identity and authorization policies to restrict access to that user's permitted data and services.
• Place APIs behind a firewall and limit request floods to help prevent denial-of-service attacks.
• Validate inputs and use firewall rules to block malicious payloads such as SQL injection, cross-site scripting, and command injection.
• Aggregate security events from firewalls, API gateways, databases, file systems, and workloads so analysts can assess and respond to attacks.
• Protect against replay attacks that reuse authenticated or authorized requests, including repeated transactions.
• Inventory and discover APIs to find endpoints that may be unprotected and directly accessible.