API Security Checklist: A Developer’s Guide

Application Programming Interfaces (APIs) play a critical role in software development by providing a way for different applications to communicate and share data. 

Recent reports confirm that security incidents involving APIs are rising, and the number of organizations facing them is alarmingly high.

This blog post shares a very basic yet detailed API Security Checklist. Developers and security teams can use this list to acknowledge potential vulnerabilities and harden APIs to become secure or reliable. Let’s get started.

What is API Security?

API security is the sum total of actions and measures implemented to protect the APIs from malicious activities or unauthorized access. The increasing importance of APIs in software applications makes them a ripe target for cyber threats. Typical vulnerabilities include poor authentication, information disclosure, and injection attacks.

API security is important to ensure that vulnerabilities do not leave your entire cyber perimeter open, resulting in significant consequences like data breaches, loss of trust, and fines when violating regulations. Running security tests during an API’s lifecycle is also important to ensure its security.

The API Security Checklist

In the following sections, we will explore critical components that must be implemented for the security of API.

1. Authentication and Authorization

Authentication and authorization are basic components of API security. First and foremost, we must ensure that users are secured using strong authentication mechanisms like OAuth 2.0 or JSON Web Token (JWT) to validate their identities properly. These advanced methods give us safety in being sure that the user who logs in is who they say they are and that the access token needs to expire.

Next, it’s recommended to use role-based access control (RBAC) to define user roles and access controls based on requirements. This guarantees that users are limited to only the resources essential for their work, reducing the chance of unauthorized access.

You can also enforce token expiration policies to restrict the time an access token is valid, narrowing down the attack window. Use token revocation methods to revoke tokens immediately when the user signs out, or suspicious activity happens.

Here’s a sample NodeJS code snippet to implement Auth using JWTs.

// import the required packages

const jwt = require('jsonwebtoken');

const express = require('express');

const app = express();

// note: use KMS to store secret key

const SECRET_KEY = 'xyzz-xyzz-xyzz-xyzz';

// sample middleware function to validate the incoming JWT token

function verifyJWTToken(req, res, next) {

  const token = req.headers['authorization'];

  if (!token) {

     return res.status(403).send({ auth: false, message: 'something went wrong' });

  }

  jwt.verify(token, SECRET_KEY, (err, decoded) => {

    if (err) {

       return res.status(500).send({ auth: false, message: 'something went wrong.' });

    }

    req.userId = decoded.id;

    next();

  });

}

app.get('/api/protected', verifyToken, (req, res) => {

  res.status(200).send('protected resource');

});

2. Encryption

Encryption is crucial to secure an API and prevent unintended third parties from intercepting or accessing data. Additionally, make sure to use HTTPS for all communications with APIs so that any data sent over a network is encrypted, preventing attackers from listening to the sensitive data being exchanged between client and server.

Apart from data in motion (transit), we must encrypt data at rest. We must utilize strong algorithms like AES (Advanced Encryption Standard) and manage the encryption keys securely. This may include something as simple as key rotation or restricting access to encryption keys.

Following is a NodeJS code snippet to implement Encryption & Decryption using AES:

const crypto_js = require('crypto-js');

const secretKey = 'xxxxxxxxx';

const data = 'sensitive info to encrypt';

const encryptedData = crypto_js.AES.encrypt(data, secretKey).toString();

console.log('Encrypted:', encryptedData);

const decryptedBytes = crypto_js.AES.decrypt(encryptedData, secretKey);

const decryptedData = decryptedBytes.toString(CryptoJS.enc.Utf8);

console.log('Decrypted:', decryptedData);

Note: Ensure that you securely fetch the secret key from KMS or a Key Vault.

3. Input Validation

It’s important to validate and sanitize all input data every time to make sure it is the data you expect from the input form. Data needs to be sanitized and validated before processing. This can be done by implementing strong regular expressions, escaping special characters, and adding strong validation, e.g., numerical inputs that only have numbers and email fields with proper valid email syntax.

For further security, whitelist the allowed input values instead of blacklist. Specifying allowed values and formats keeps you safe from wrong or harmful data. Also, use regular expressions for complex validation situations and enable input validations on various layers of your application.

Why Astra is the best in API Pentesting?

• We’re the only company that combines artificial intelligence & manual pentest to create a one-of-a-kind pentest platform.
• Runs 120+ test cases based on industrial standards.
• Integrates with your CI/CD tools to help you establish DevSecOps.
• A dynamic vulnerability management dashboard to manage, monitor, and assess APIs your web app consumes.
• Conduct 2 rescans in 60 days to verify patches.
• Award publicly verifiable pentest certificates which you can share with your users.
• Helps you stay compliant with SOC2, ISO27001, PCI-DSS, HIPAA, etc.
• Trusted by the brands you trust like Agora, Spicejet, Muthoot, Dream11, etc.

Let’s Talk Get Started

4. Rate Limiting

Rate limiting is an important aspect of API security that can prevent abuse. Use it to control how many requests a user can make in a given time frame so that your API does not become overrun with overhead and will prevent denial of service attacks This functionality can be achieved by implementing a leaky bucket algorithm, enabling a limited and intended amount of requests to go through.

Throttling techniques can be used to dynamically alter the rate limits based on user behaviors or API usage patterns. For example, you can set a higher limit for authorized users and more restrictive limits on suspicious or new ones. Using different thresholds for different classes of users can offer a better experience while still providing protection.

Following is the code snippet using NodeJS to rate-limit:

const express = require('express');

const rateLimit = require('express-rate-limit');

const app = express();

const apiLimiter = rateLimit({

  windowMs: 15 * 60 * 1000,

  max: 100,

  message: 'try again later'

});

app.use('/api/', apiLimiter);

app.get('/api/data', (req, res) => {

  res.json({ message: 'API response' });

});

5. Security Headers

Using security headers is one approach to secure APIs from common vulnerabilities. Configure headers like CSP (Content Security Policy) and X-Content-Type-Options to protect your site from XSS or content type sniffing. These headers tell browsers how to handle content, restrain dangerous activities and keep attackers from running code on your site.

Developers can use X-Frame-Options to stop clickjacking or Strict Transport Security (HSTS) which forces secure connections. It is also very important to configure the correct CORS policies. CORS limits which domains are allowed to access your API resources. Set these headers to only be allowed from trusted domains and also set the types of cross-origin requests that method can run.

6. Security Testing

Having routine security testing in place ensures that you uncover and mitigate issues with your APIs. Run thorough penetration tests mimicking real-world attacks to see your levels of security in place, and the chances cybercriminals can easily bypass these measures. This helps to identify vulnerabilities which bad actors can exploit before they happen. Make sure you run these tests frequently, especially after a major change in the codebase or API functionality.

If you are still performing manual testing, switch to automated security scanning tools such as Astra, which will constantly check your APIs for various known vulnerabilities and misconfigurations. These tools will also alert you to your current security vulnerabilities so you can direct your development team to fix them first. 

7. Implementing an API Gateway

The API gateway is a central proxy handler that handles all external user traffic and also enforces security policies. It allows you to centralize authentication, authorization, and request validation, enabling a single access point for all of your APIs. Not only does this simplify management, but it also provides an added security measure by separating the client from back-end services.

Additionally, use the gateway for extra-level security capabilities like IP whitelisting (limiting access to your API by pre-registered IPs) and request validation to ensure incoming requests adhere only to certain criteria you specified.

An API gateway can also help log and monitor incoming API requests, which is important for detecting if an API is under attack. You can also add rate limit/throttle requests at your gateway level to help protect against potential abuse.

Best Practices for API Security

You need to take various measures to protect your APIs (and, as a result, the data they access). By following these best practices, you will improve the security level of your APIs and prevent threat actors from unauthorized access and other potential attacks against your data.

• Enforce Authentication & Authorization: Use a strong auth solution, i.e., OAuth 2 or JWT, to identify the user securely. This, combined with role-based access control (RBAC), helps to provide granular permissions in a manner that would mean that users can only interact with the resources relevant to their operational roles.
• Use HTTPS Everywhere: Always use HTTPS for all API communication to ensure encryption of your user data in transit. This helps prevent attackers from capturing or intercepting sensitive information. Keep your SSL/TLS certificates updated and configured to avoid potential security vulnerabilities.
• Update and Patch Your APIs as Required: Make it a standard practice to update your API libraries with the latest security updates. Outdated software components can introduce vulnerabilities, so ensure you regularly review and update libraries, frameworks, dependencies, etc.
• Penetration Testing: Regular security assessments, such as penetration testing and vulnerability scanning, should be performed to detect any weak points in your APIs. Use both automated tools and manual testing methods to discover security risks.

Astra Pentest is built by the team of experts that helped secure Microsoft, Adobe, Facebook, and Buffer

Book a Demo View Pricing

Final Thoughts

To sum up, protecting your APIs is vital in today’s digital world. This should sound familiar by now: strong authentication, HTTPS, regular system updates, and thorough security testing will improve your API security posture and keep sensitive data safe.

For complete API Security solutions, you should consider Astra Security (with their expert Pentesting services and automated scanning, which has more than 9300 tests) to protect your APIs from threats. Don’t compromise the security of your API; get in touch with Astra Security!

FAQs