繁中版 | 簡中版 | Português (Brasil) | Français | 한국어 | Nederlands | Indonesia | ไทย | Русский | Українська | Español | Italiano | 日本語 | Deutsch | Türkçe | Tiếng Việt | Монгол | हिंदी | العربية | Polski | Македонски | ລາວ
API Security Checklist
Checklist of the most important security countermeasures when designing, testing, and releasing your API.
Authentication
- Don't use
Basic Auth
. Use standard authentication (e.g. JWT, OAuth). - Don't reinvent the wheel in
Authentication
,token generation
,password storage
. Use the standards. - Use
Max Retry
and jail features in Login. - Use encryption on all sensitive data.
JWT (JSON Web Token)
- Use a random complicated key (
JWT Secret
) to make brute forcing the token very hard. - Don't extract the algorithm from the payload. Force the algorithm in the backend (
HS256
orRS256
). - Make token expiration (
TTL
,RTTL
) as short as possible. - Don't store sensitive data in the JWT payload, it can be decoded easily.
OAuth
- Always validate
redirect_uri
server-side to allow only whitelisted URLs. - Always try to exchange for code and not tokens (don't allow
response_type=token
). - Use
state
parameter with a random hash to prevent CSRF on the OAuth authentication process. - Define the default scope, and validate scope parameters for each application.
Access
- Limit requests (Throttling) to avoid DDoS / brute-force attacks.
- Use HTTPS on server side to avoid MITM (Man in the Middle Attack).
- Use
HSTS
header with SSL to avoid SSL Strip attack.
Input
- Use the proper HTTP method according to the operation:
GET (read)
,POST (create)
,PUT/PATCH (replace/update)
, andDELETE (to delete a record)
, and respond with405 Method Not Allowed
if the requested method isn't appropriate for the requested resource. - Validate
content-type
on request Accept header (Content Negotiation) to allow only your supported format (e.g.application/xml
,application/json
, etc.) and respond with406 Not Acceptable
response if not matched. - Validate
content-type
of posted data as you accept (e.g.application/x-www-form-urlencoded
,multipart/form-data
,application/json
, etc.). - Validate user input to avoid common vulnerabilities (e.g.
XSS
,SQL-Injection
,Remote Code Execution
, etc.). - Don't use any sensitive data (
credentials
,Passwords
,security tokens
, orAPI keys
) in the URL, but use standard Authorization header. - Use an API Gateway service to enable caching, Rate Limit policies (e.g.
Quota
,Spike Arrest
, orConcurrent Rate Limit
) and deploy APIs resources dynamically.
Processing
- Check if all the endpoints are protected behind authentication to avoid broken authentication process.
- User own resource ID should be avoided. Use
/me/orders
instead of/user/654321/orders
. - Don't auto-increment IDs. Use
UUID
instead. - If you are parsing XML files, make sure entity parsing is not enabled to avoid
XXE
(XML external entity attack). - If you are parsing XML files, make sure entity expansion is not enabled to avoid
Billion Laughs/XML bomb
via exponential entity expansion attack. - Use a CDN for file uploads.
- If you are dealing with huge amount of data, use Workers and Queues to process as much as possible in background and return response fast to avoid HTTP Blocking.
- Do not forget to turn the DEBUG mode OFF.
Output
- Send
X-Content-Type-Options: nosniff
header. - Send
X-Frame-Options: deny
header. - Send
Content-Security-Policy: default-src 'none'
header. - Remove fingerprinting headers -
X-Powered-By
,Server
,X-AspNet-Version
, etc. - Force
content-type
for your response, if you returnapplication/json
then your responsecontent-type
isapplication/json
. - Don't return sensitive data like
credentials
,Passwords
, orsecurity tokens
. - Return the proper status code according to the operation completed. (e.g.
200 OK
,400 Bad Request
,401 Unauthorized
,405 Method Not Allowed
, etc.).
CI & CD
- Audit your design and implementation with unit/integration tests coverage.
- Use a code review process and disregard self-approval.
- Ensure that all components of your services are statically scanned by AV software before pushing to production, including vendor libraries and other dependencies.
- Design a rollback solution for deployments.
See also:
- yosriady/api-development-tools - A collection of useful resources for building RESTful HTTP+JSON APIs.
Contribution
Feel free to contribute by forking this repository, making some changes, and submitting pull requests. For any questions drop us an email at team@shieldfy.io
.