REST-based API Security Recommendations

Ensuring that the best cost-effective approaches to REST-based API security are being used needs a coordinated effort between the security professional and development managers in the organization.

Security professionals should work with development managers in their organizations, or with individual developers, to ensure the adoption and use of practices such as the following:

• Employ the same security mechanisms
• Unless your API is a free, readfor APls as any other web application only public API, do not use single your organization deploys. For example, if key-based authentication. It is not you are filtering for cross-site scripting enough. You should add a strong (XSS) on the web front-end, you must do password requirement. it for your APls, preferably with the same
• Do not pass unencrypted static

tools.

encryption keys. If you are using HTTP and sending it across the wire, then make sure

• Do not create and implement your own security solutions. Use a framework

you always encrypt it. or existing library that has been peer-

• Ideally, use hash-based message

reviewed and tested. Developers not authentication code (HMAC) because it familiar with designing secure systems is the most secure. Use SHA-2 or SHAmay often produce flawed security

3 (which provides great security). Avoid implementations if they try on their own, SHA-1 and MD5 because of their known and they may leave their APls vulnerable vulnerabilities and weaknesses. to attack as a result.

Security professionals may also need to provide guidance on the use of authentication protocols with regard to REST APls in the enterprise.

Additional resource: OWASP REST Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat. Sheet.html