Securing APIs
1. Using HTTPS/TLS
| Setting | Recommendation |
|---|
| TLS version | 1.2 minimum, 1.3 preferred |
| Cipher suites | Forward secrecy (ECDHE) |
| HSTS | Strict-Transport-Security: max-age=31536000; includeSubDomains |
| Certificate | Let's Encrypt (free), commercial CA, ACME automation |
| Disable | SSL 3.0, TLS 1.0/1.1, weak ciphers |
| Threat | Defense |
|---|
| SQL injection | Parameterized queries |
| NoSQL injection | Type validation, reject operators |
| XSS (returned in HTML) | Output encoding, CSP |
| XML injection / XXE | Disable DTD processing |
| SSRF | Allowlist outbound URLs |
| Mass assignment | Allowlist DTO fields |
3. Implementing CSRF Protection
| Defense | Use With |
|---|
| SameSite cookies | SameSite=Lax default; Strict for sensitive |
| CSRF token (synchronizer) | Form-based; verify on POST |
| Double-submit cookie | Stateless variant |
| Custom header | JS sets X-CSRF-Token; CORS prevents cross-origin |
| Bearer tokens | Immune (no cookie auto-send) |
| Header | Value |
|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Content-Security-Policy | default-src 'self'; frame-ancestors 'none' |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | geolocation=(), microphone=() |
5. Implementing API Key Rotation
| Practice | Reason |
|---|
| Allow multiple active keys | Zero-downtime rotation |
| Per-key expiration | Force periodic rotation |
| Audit logs per key | Track usage, detect leak |
| Auto-revoke leaked keys | Detect via secret scanning |
6. Avoiding Sensitive Data in URLs
Warning: URLs are logged in: server access logs, browser history, referrer headers, proxy logs, analytics. Never put: tokens, passwords, PII, API keys.
| Bad | Good |
|---|
?token=abc123 | Authorization: Bearer abc123 |
?password=... | POST body |
?ssn=123-45-6789 | POST body, encrypted |
7. Implementing IP Whitelisting
| Use Case | Notes |
|---|
| Server-to-server APIs | Static IPs known |
| Admin endpoints | Office VPN range |
| B2B integrations | Per-tenant CIDR list |
| Limitations | NAT, dynamic IPs, mobile users |
| API-Specific Header | Value |
|---|
Cache-Control | no-store for sensitive responses |
Pragma | no-cache (HTTP/1.0 fallback) |
Expect-CT DEPRECATED | Cert Transparency now mandatory in browsers |
9. Implementing Request Signing
Example: HMAC Request Signing
// Canonical string: METHOD\nPATH\nTIMESTAMP\nBODY_HASH
String canonical = req.getMethod() + "\n" + req.getPath() + "\n"
+ timestamp + "\n" + sha256(req.getBody());
String signature = hmacSha256(canonical, secretKey);
// Headers
req.setHeader("X-Timestamp", timestamp);
req.setHeader("X-Signature", "v1=" + signature);
// Server: reject if timestamp is > 5 min old, or signature mismatches
10. Logging Security Events
| Event | Log Level |
|---|
| Failed login | WARN |
| Account lockout | WARN |
| Permission denied | WARN |
| Token issued/revoked | INFO |
| Suspicious patterns | ALERT |
| API key created/deleted | AUDIT |
11. Implementing DDoS Protection
| Layer | Mitigation |
|---|
| Network (L3/L4) | Cloudflare, AWS Shield, BGP scrubbing |
| Application (L7) | Rate limiting, WAF rules, bot detection |
| Auth | CAPTCHA after threshold |
| Caching | CDN absorbs static traffic |
| Auto-scaling | Absorb sustained surges |
12. Conducting Security Audits
| Audit Type | Frequency |
|---|
| OWASP API Top 10 review | Annual |
| Penetration test | Annual + major releases |
| Dependency scan (SCA) | Continuous (Dependabot, Snyk) |
| Static analysis (SAST) | Per commit |
| Dynamic analysis (DAST) | Per release |
| Secrets scanning | Per commit (gitleaks, trufflehog) |