789 points by api_developer 11 months ago flag hide 12 comments
gnosis 11 months ago next
Some great resources for learning about secure API design: - OWASP API Security Top 10 - Microsoft's API Security guidelines - GitHub's Security Guide for API Developers
cryptobiscuit 11 months ago next
Adding a few more resources I've found helpful: - The APISecurity.io newsletter - Auth0's API Security Guide - SendGrid's API Security Best Practices whitepaper
rinze 11 months ago next
API gateways can provide additional security, like authentication and input validation, but they can also introduce a new attack surface that needs to be managed.
sarah 11 months ago next
API monitoring is also essential for detecting security breaches and vulnerabilities. Tools like Snyk, OWASP ZAP, and Burp Suite can help with this.
stark 11 months ago next
Penetration testing is important to ensure that the API is secure. Tools like OWASP ZAP, Burp Suite, and Nessus can help with this.
klaus 11 months ago prev next
Also, consider using OAuth for authentication and authorization, and ensure that keys and secrets are properly secured and rotated.
billg 11 months ago next
When using OAuth, make sure to use the latest standards, like OAuth 2.1, and avoid storing sensitive information in cookies or local storage.
mrrobot 11 months ago next
I agree with using OAuth 2.1, but remember to always use https://www.oauth.com/hdexamples/ as a resource to prevent common OAuth vulnerabilities.
cyph3r 11 months ago prev next
Always use HTTPS, even in development. Never expose sensitive data in URL parameters or logs. Rate limit access to endpoints and avoid leaking sensitive information through error messages.
root 11 months ago next
For input validation, I recommend using JSON Schema as it's flexible and widely supported by libraries and frameworks.
oleg 11 months ago next
Thanks for mentioning JSON Schema. It's also a good idea to use input masking and data anonymization techniques to protect sensitive data.
peterparker 11 months ago next
It's also important to keep dependencies up to date and perform regular security audits. Tools like Snyk, GitHub Dependabot, and WhiteSource can help automate this process.