liveBookmanning.com

What you will learn in Secure APIs

Design, build, and implement

by José Haro Peralta
Foreword by Dan Barahona

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• contractA defined software interface through which applications or services expose data and functionality to other software.
• API securityThe discipline of protecting application programming interfaces, including their exposed data, functionality, and access paths, from misuse and attack.
• authenticationAuthentication is the process of verifying the identity of a user, service, or other entity requesting access.
• secure by designAPI security by design is an API security approach that incorporates security concerns from API design through the entire development cycle.
• claimA token claim is a named statement or attribute encoded in a security token, such as a user's role or permission.
• authorizationAn access authorization control determines which authenticated subjects are permitted to perform particular actions on protected resources.
• role-based access controlRole-based access control is an authorization model that grants permissions according to assigned user roles.
• API keyAn API key is a credential string that identifies or authorizes a client when it accesses an API.
• threat modelA threat model is a structured representation of a system's potential threats, attack paths, vulnerabilities, and impacts.
• JSON Web TokenA JSON Web Token is a compact, URL-safe token format for representing claims that can be digitally signed or encrypted.
• privilege escalationPrivilege escalation is the gaining of permissions or capabilities beyond those originally authorized for a user, service, or process.
• signature algorithmA signing algorithm is a cryptographic algorithm that generates or verifies signatures on digital data.
• monitoringA log is a recorded entry describing an event, action, or state change in a software system.
• security postureA security posture is the overall condition of an organization's or system's security controls, exposure, readiness, and risk.
• insecure direct object referenceBroken object-level authorization is a vulnerability in which an API fails to verify that a requester may access a specific object.
• observabilityAPI observability is the ability to infer the health, behavior, and security-relevant activity of APIs from their telemetry.
• token validationToken validation is the process of checking a token's format, expiration, signature, and other validity conditions.
• web application firewallA web application firewall filters HTTP traffic to protect web applications and APIs from malicious requests.
• denial-of-service attackA denial-of-service attack is an attack intended to make a service or resource unavailable to legitimate users, including by exhausting its processing or storage resources.
• identity as a serviceIdentity as a service is a hosted identity-management capability that provides functions such as authentication, identity storage, and access federation.
• HS256HS256 is the JWT algorithm identifier for HMAC using SHA-256.
• RS256RS256 is the RSA-based signature algorithm designation that combines RSASSA-PKCS1-v1_5 with SHA-256.
• symmetric signing algorithmA symmetric signing algorithm uses the same shared secret key to generate and verify a message authentication code or signature.
• zero-trust networkingA security model that continuously verifies requests, denies implicit trust, and grants only explicitly authorized access regardless of network location or origin.
• rsa-pssPS256 is the JWT algorithm identifier for RSA-PSS signatures using SHA-256.
• broken authenticationBroken authentication is a vulnerability in which flaws in identity verification or session handling allow an unauthorized actor to access protected functionality or data.
• OpenTelemetryOpenTelemetry is an open-source, vendor-neutral observability framework that defines APIs, SDKs, and conventions for generating, collecting, and exporting telemetry.
• unrestricted access to sensitive business flowsA business flow exploit is an attack that abuses the intended sequence or rules of application actions to gain an unauthorized benefit or cause business harm.
• paginationPagination is the technique of dividing a large collection of API results into separately retrievable pages.
• digital signatureA token signature is cryptographic data that allows a recipient to verify that a token was issued by a trusted party and has not been altered.
• network segmentationNetwork segmentation is the practice of dividing a network into isolated subnets to limit communication between components with different risk profiles.
• payloadA request payload is the data sent to an API server in the body of a request to create or update a resource.
• attack vectorAn attack vector is a path, method, or weakness through which an attacker can compromise or misuse a system or API.
• schemaA schema is a formal structure that defines the shape and permitted content of data in requests or responses.
• openid connectOpenID Connect is an identity layer on top of OAuth 2.0 that enables clients to verify an end user's identity and obtain basic profile claims.
• fuzzingFuzzing is software testing that supplies varied, malformed, or unexpected inputs to discover faults and vulnerabilities.
• PyJWTPyJWT is a Python library for encoding and decoding JSON Web Tokens.
• OIDC discoveryAn OIDC discovery endpoint is a well-known URL that publishes an identity provider's protocol endpoints, capabilities, and other integration metadata.
• SSRFA vulnerability in which an attacker causes a server to issue requests to attacker-selected external or internal destinations.
• unsafe consumption of apisUnsafe consumption of APIs is a vulnerability in which an application consumes malicious or malformed data from an external API without adequate validation or sanitization.
• shift leftShift left is a software security approach that moves security activities earlier in the development lifecycle.
• FAPIFAPI 2.0 is the broader version of FAPI that applies strengthened security requirements across financial and other high-security API domains.
• RSARSA is a public-key cryptosystem based on the computational difficulty of factoring large integers.
• JWT-secured authorization requestA JWT-secured authorization request is an authorization request whose parameters are protected in a signed or encrypted JWT request object.
• pushed authorization requestAn OAuth mechanism in which a client submits an authorization request object to an authorization server before initiating the user-facing authorization request.
• enumAn enumeration is a type whose permitted values are restricted to a finite, explicitly defined set of named alternatives.
• contract testingContract testing is a testing approach that verifies an API implementation conforms to an agreed API contract or specification.
• authorization code flowThe authorization code flow is an OAuth authorization flow in which a client obtains an authorization code through user authorization and exchanges it for tokens.
• authorization codeAn authorization code is a short-lived credential issued by an authorization server that a client exchanges for an access token.
• user-based securityAn authorization model that grants permissions directly according to individual user identities.
• data modelA data model is a structured representation of entities, attributes, relationships, and constraints, potentially including validation rules for accepted data.
• internal APIAn internal API is an API intended for use within an organization or its private infrastructure rather than for public access.
• API testingAPI security testing is the systematic evaluation of an API's behavior, interfaces, data handling, and security properties.
• HMACHMAC is a message authentication code construction that combines a hash function with a secret key to authenticate data.
• rate limitRate limiting is the restriction of how many requests a client or identity can make during a defined interval.
• SQL injectionAn SQL injection attack abuses application input handling to manipulate a database query through unsafely handled input.
• JWT headerA token header is the metadata-bearing section of a JWT that identifies properties such as its signing algorithm.
• network topologyNetwork topology is the arrangement and connectivity relationships among networks, hosts, and communication components.
• private keyA private key is the secret half of an asymmetric cryptographic key pair used to create digital signatures or perform private-key operations.
• public keyA public key is the openly distributable half of an asymmetric cryptographic key pair used to verify signatures or perform public-key operations.
• performanceA metric is a quantifiable measure used to evaluate a property, outcome, or performance characteristic of a system or process.
• telemetryData and signals emitted by software about its execution, health, and behavior.
• base64url encodingBase64url encoding is a variant of base64 encoding that replaces URL-sensitive characters and omits padding for safe use in URLs.
• deployment pipelineContinuous integration and delivery is an automated practice for frequently integrating code changes and validating or releasing them through a delivery pipeline.
• authorization requestAn authorization request is a client's request for permission to access protected resources with specified client and scope information.
• attribute-based access controlAttribute-based access control is an authorization model that determines permissions from attributes of users, resources, and contextual conditions.
• malicious dataMalicious input is data deliberately crafted to exploit an application's parsing, processing, or business logic.
• public-private key pairA public-private key pair consists of mathematically related cryptographic keys, with the private key used for signing and the public key used for verification.
• OSI network modelThe OSI model is a seven-layer conceptual framework for describing communication functions between networked systems.
• OpenAPI specificationOpenAPI is a standard format for describing HTTP APIs, including their operations, parameters, request bodies, responses, and security requirements.
• authorization serverAn authorization server is a service that authenticates resource owners, obtains their consent, and issues authorization credentials such as authorization codes and access tokens.
• api security programAn API security strategy is a coordinated plan for protecting APIs in alignment with an organization's goals, requirements, and risk priorities.
• ArazzoThe Arazzo Specification is a standard for describing API workflows, their required steps, and the relationships among those steps.
• security profileA structured representation of the access requirements and restrictions associated with an API's resources and operations.
• authenticated encryption with associated dataAuthenticated encryption is encryption that provides confidentiality and integrity for ciphertext and optionally associated unencrypted data.
• ciphertextCiphertext is data produced by encrypting plaintext so that it is not readable without the required decryption capability.
• compact serializationCompact serialization represents a JOSE object as dot-separated base64url-encoded components.
• message authentication codeAn authentication tag is cryptographic output used to verify the integrity and authenticity of authenticated-encrypted data.
• sender-constrained tokenA sender-constrained token is a token cryptographically or transport-layer bound to a particular legitimate presenter so that possession alone is insufficient for its use.
• api sprawlAPI sprawl is the uncontrolled proliferation of APIs, often involving duplication, undocumented interfaces, and inadequate security oversight.
• vulnerabilityAn API vulnerability is a weakness in an API or its surrounding implementation that can be exploited to compromise confidentiality, integrity, availability, or authorization.
• sensitive business flowA sensitive business flow is a business process whose exploitation benefits a threat actor while harming the organization that operates it.
• sensitive data overexposureExcessive data exposure is a vulnerability in which an API returns more data, objects, or identifiers than the requester needs or is authorized to receive.
• SchemathesisSchemathesis is an open-source API testing tool that generates property-based tests from API schemas.
• HTTP/2 multiplexingHTTP/2 multiplexing is an HTTP/2 feature that carries multiple concurrent request and response streams over a single connection.
• ICMP floodAn ICMP flood is a denial-of-service technique that sends large numbers of ICMP packets to consume a server's resources.
• IP spoofingIP spoofing is a technique that forges the source IP information in network packets to make traffic appear to originate from another address.
• security hardeningServer hardening is the practice of reducing a server's attack surface by disabling unnecessary services, restricting access, and applying restrictive security configurations.
• volumetric denial-of-service attackA volumetric denial-of-service attack overwhelms a target with a very large volume of network traffic or requests.
• data transfer objectA data transfer object is a data structure used to carry structured data between software layers or processes without encapsulating domain behavior.
• confidential clientA confidential client is an OAuth client capable of keeping its credentials secret securely.
• JSON Web KeyA JSON Web Key is a JSON data structure representing a cryptographic key and its associated parameters.
• correlation idA trace ID is an identifier shared by telemetry records belonging to the same request execution or distributed processing path.
• infrastructureComputing infrastructure is the collection of networks, servers, traffic-management components, and security controls that supports software operation.
• demilitarized zoneA demilitarized zone is a hardened network segment exposed to untrusted external traffic and positioned between the internet and an internal network.
• api catalogAn API catalog is a centralized, maintained inventory that lists an organization's APIs and provides information for discovering and understanding them.
• api discoveryAPI discovery is the process of identifying APIs and attack-surface elements that are deployed or exposed but not known to the organization.
• ghost apiA ghost API is an API exposed by a library, infrastructure component, or other third party rather than deliberately created and managed by the organization.
• shadow apiA shadow endpoint is an exposed API endpoint that is not documented, inventoried, or governed through the organization’s normal API management processes.
• zombie apiA zombie API is a deprecated or forgotten API that is no longer maintained but remains exposed and accessible.
• OpenSSLOpenSSL is an open-source toolkit implementing cryptographic protocols, algorithms, certificates, and key-management operations.
• api gateway patternThe API gateway pattern exposes a single entry point that mediates access to multiple backend APIs.
• backend-for-frontend patternThe backends-for-frontends pattern provides client-specific backend interfaces tailored to the needs of different frontend applications.
• MQTTMQTT is a lightweight publish-subscribe messaging protocol for asynchronous communication between machines.
• key identifierThe kid field is a JWK or JWT member that identifies a cryptographic key by a provider-assigned key identifier.
• network configurationNetwork configuration consists of the settings that determine how networked components communicate and are exposed or isolated.
• flow trackerA flow tracker is state that records a user's completed workflow steps and associated interaction timing.
• null byte injectionNull byte injection is an attack in which a null character embedded in input is interpreted as a string terminator or otherwise bypasses application validation.
• schema enumerationA schema enumeration attack probes API parameters or responses to discover hidden database fields, columns, or configuration details.
• spanA span is a recorded unit of work representing a step in the processing of a request or operation.
• bastion hostA bastion server is a hardened intermediary host that provides controlled access to systems on an otherwise private network.
• lateral movementLateral movement is an attacker's progression between systems or network segments after gaining an initial foothold.
• data flowA data flow is a representation of how data moves between components, users, and external systems.
• predictable identifier methodA predictable identifier is an identifier whose value follows a pattern that can be inferred from other identifiers.
• OAuthOAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.
• threat prioritizationThreat prioritization is the process of identifying potential threats and ranking them according to factors such as likelihood and business effect.
• Proof Key for Code ExchangeProof Key for Code Exchange (PKCE) is an OAuth security extension in which a client binds an authorization-code request to a proof derived from a secret.
• 403 ForbiddenThe HTTP 403 status code indicates that the server understood a request but refuses to authorize it, typically because the requester lacks sufficient permissions.
• property enumerationProperty enumeration is an exploit that reveals fields of an application's data models that are not intended for external users.
• authorization endpointAn authorization endpoint is an identity or authorization service endpoint where a client initiates a user authorization and authentication flow.
• parameterized queryA parameterized query is a database query whose code and externally supplied values are transmitted separately so values cannot alter the query structure.
• nonrepudiationNonrepudiation is the property that prevents a party from credibly denying authorship or approval of an action or message.
• unrestricted resource consumptionUnrestricted resource consumption is a vulnerability in which an attacker can cause an API or its infrastructure to consume resources without effective limits.
• mass-assignment attackA mass assignment attack abuses automatic mapping of client-supplied properties to modify fields that should not be writable by the client.
• endpointAn API endpoint is a network-accessible interface location that exposes one or more API operations.
• attack surfaceAn attack surface is the collection of exposed interfaces, components, and entry points through which an attacker may affect a system.
• reverse proxyA reverse proxy receives client requests and forwards them to backend servers on the clients' behalf.
• middlewareMiddleware is software that intercepts and processes requests or responses between a client and an application endpoint.
• broken function-level authorizationBroken function-level authorization is a vulnerability in which an API fails to enforce authorization for a function or operation, allowing users without the required permissions to invoke it.
• 401 unauthorizedThe HTTP 401 status code indicates that a request lacks valid authentication credentials.
• pytestpytest is a Python testing framework for discovering and running tests with assertions, fixtures, and extensible plugins.
• mutual TLSMutual Transport Layer Security is a TLS configuration in which both communicating parties authenticate each other with certificates.
• misconfigurationA misconfiguration is a security-relevant condition in which system or application settings are incorrect, unsafe, or insufficiently restrictive.
• private subnetA private subnet is a cloud network subnet that lacks direct internet exposure and is intended for internally accessed resources.
• input constraintAn input constraint is a restriction on an input field's permitted type, size, values, or format.
• pagination attackA pagination attack abuses collection-pagination inputs to request excessive amounts of data or work from an API.
• audience parameterAn audience parameter identifies the protected API or resource server for which an authorization request or token is intended.
• security schemeA security scheme is an OpenAPI configuration object that describes how an API request is authenticated and authorized, including credential type, placement, and scopes.
• STRIDESTRIDE is a threat-modeling methodology that classifies threats as spoofing, tampering, repudiation, information disclosure, denial of service, or elevation of privileges.
• JARMJARM is an OAuth response mode that returns authorization responses in signed JWTs so clients can verify their origin and integrity.
• credential managementCredential management is the practice of creating, storing, protecting, validating, and replacing authentication credentials.
• credential replayCredential replay is the reuse of intercepted credentials to impersonate the credential owner.
• credential stuffingCredential stuffing is an attack that tries leaked username-and-password pairs against other services to take over accounts.
• token tampering attackA token tampering attack modifies a security token so that its claims or validation behavior grant unauthorized access.
• user enumerationUser enumeration is the discovery of which user identities or accounts are registered in a system.
• OpenID Connect ID tokenAn ID token is a token issued by an identity provider that conveys claims about an authenticated user or authentication event to a client.
• API documentationAPI documentation is written technical material that describes how to use an API and its available interface.
• api security maturityAPI security maturity is the degree to which an organization's API security practices are established, effective, current, and continuously improved.
• identity providerAn identity provider is a service that authenticates identities and issues identity or authorization artifacts to relying clients.
• vulnerable api designVulnerable API design is an API design that contains security weaknesses inherent in its specified behavior or constraints.
• microsegmentationMicrosegmentation is the division of a network into finely grained isolated zones with distinct access controls.
• public subnetA public subnet is a cloud network subnet with a route or configuration that permits internet connectivity.
• security groupA security group is a cloud network control that permits or restricts traffic according to sources, destinations, protocols, or ports.
• VPCA virtual private cloud is an isolated virtual network environment provided within a cloud platform.
• server-side propertyA server-side property is a data field whose value or authority is maintained by the server rather than supplied for client control.
• api security posture assessmentAn API security audit is a systematic examination of an organization’s API security controls, practices, and risk posture.
• data inventoryA data inventory is a catalog of the data an organization possesses, exposes, or processes and the locations where it resides.
• distributed denial of service attackA distributed denial-of-service attack is a denial-of-service attack that uses traffic or requests from multiple distributed sources to overwhelm a service or resource.
• overpostingMass assignment is an object-binding behavior that maps multiple client-supplied fields directly onto an application's object or model.
• request URIA request URI is a short-lived, usually one-time identifier from which an authorization server retrieves a registered authorization request object.
• resource enumerationResource enumeration is the process of discovering which resources exist by probing an application's responses.
• unconstrained user inputUnconstrained user input is client-supplied data accepted by an API without effective restrictions on its values, size, type, or format.
• private_key_jwtprivate_key_jwt is a client authentication method in which a client signs a one-time-use JWT with a previously registered private key.
• unique identifierA database identifier is a value that uniquely distinguishes a stored record or entity within a database.
• shield rightA security approach that emphasizes protecting APIs after they have been released.
• three axes of api securityA framework for analyzing API vulnerabilities across design, implementation, and infrastructure.
• OpenAPI security fieldAn OpenAPI security field is a specification field that assigns security requirements globally or to an individual API operation.
• token endpointA token endpoint is an authorization server endpoint that exchanges an authorization grant for an access token.
• denial-of-wallet attackA denial-of-wallet attack exploits automatically scaling cloud infrastructure to cause financial harm through excessive resource consumption.
• HTTP/2 Rapid ResetHTTP/2 Rapid Reset is a denial-of-service vulnerability in HTTP/2 connection cancellation handling that can cause servers to retain canceled connections.
• instrumentationInstrumentation is the practice of preparing software to emit telemetry and collecting that telemetry for analysis.
• large payload attackA large payload attack submits excessively large request data to consume resources or degrade service availability.
• authorization flowAn authorization flow is a protocol sequence through which a client obtains permission and an access token to access protected resources.
• algorithm confusion attackAlgorithm confusion is a token-validation vulnerability in which an attacker causes a verifier to interpret or accept a token under an unintended signing algorithm.
• JSON Web Key SetA JSON Web Key Set is a JSON structure containing a set of JSON Web Keys for cryptographic key distribution.
• api inventoryAn API inventory is a maintained catalog of an organization's deployed and exposed APIs and their relevant metadata.
• injection attackAn injection attack is an attack in which crafted input is interpreted as commands, code, or query structure by a target system.
• log aggregationA log aggregator is a system that receives log records from multiple sources for centralized storage, search, and analysis.
• log routerA log router is a component that collects, filters, transforms, and forwards log records to downstream storage or analysis systems.
• sidecar processA sidecar is a container-application pattern in which a secondary process runs alongside a primary application to provide supporting functionality.
• DPoPA DPoP JWT is a signed JSON Web Token containing proof-of-possession claims for one HTTP request.
• api security readinessAPI security readiness is the extent to which an organization has established the information, controls, and processes needed to address API security requirements.
• test fixtureA pytest fixture is a reusable test setup function that supplies data or resources to test functions and may manage their preparation and cleanup.
• token introspectionA token introspection endpoint is an authorization-server endpoint that returns metadata about an access token to an authorized client or resource server.
• open bankingOpen banking is a financial-services model in which institutions expose customer-authorized financial data and capabilities through APIs to third-party providers.
• API Security Top 10The OWASP Top 10 API Security Risks is a published list of the most critical and prevalent security risks specific to application programming interfaces.
• protected attributesProtected attributes are model properties configured to reject direct assignment through a mass-assignment mechanism.
• CAPTCHAA CAPTCHA is an automated challenge-response test intended to distinguish human users from automated programs.
• scalper botA scalper bot is an automated program that monitors availability and rapidly purchases scarce products, tickets, or booking slots for resale.
• principle of least privilegeA security principle that grants each user, service, or process only the minimum access required for its authorized tasks.
• explicit user consentConsent is an explicit approval by a resource owner allowing a client application to access resources or act on the owner's behalf.
• scrapingWeb scraping is the automated extraction of content or data from websites or web-accessible services.
• integration testAn integration test verifies that multiple software components work together as intended.
• software composition analysisSoftware composition analysis examines third-party and open-source dependencies to identify their components, licenses, and known vulnerabilities.
• static application security testingStatic application security testing analyzes application source code or related artifacts without executing the application to identify security flaws and misconfigurations.
• bearer authenticationA bearer token is an access credential whose possession is sufficient to present it for authorization without proving possession of a separate key.
• side-channel attackA side-channel attack infers information about a system from inadvertently exposed characteristics of its operation rather than from its intended outputs.
• device fingerprintA device fingerprint is a set of observable device and software characteristics used to distinguish or associate a client device.
• endpoint-level request metricAn endpoint-level request metric is a quantitative measurement of requests directed to a particular API endpoint over time.
• enumeration attackObject enumeration is an attack pattern in which repeated API requests discover valid object identifiers or existing records.
• server mocking libraryA mock server is a server that simulates an API's specified behavior for development and testing.
• cnf claimA cnf claim is a JWT confirmation claim that conveys information needed to prove possession of an associated cryptographic key or certificate.
• promo fraudPromo fraud is the abuse of promotional incentives, such as signup or referral rewards, through fraudulent accounts or activity.
• index-based paginationOffset-based pagination retrieves a collection by specifying the number of items to skip and the number of items to return.
• improper inventory managementImproper inventory management is a vulnerability caused by insufficient tracking and lifecycle control of API versions, endpoints, environments, and documentation.
• OpenID Connect providerAn OpenID Provider is an identity provider that authenticates users and issues OpenID Connect tokens to relying parties.
• application decompositionApplication decomposition is the analysis of an application’s structure, components, and interactions for security assessment.
• autoinstrumentationAutoinstrumentation is the automatic addition of telemetry instrumentation to an application without manually inserting instrumentation at each observation point.
• api-first architectureAPI design first is an approach that defines an API before implementing its producer or consumer.
• client idAn identifier that distinguishes an OAuth client application to an authorization server.
• cross-site request forgeryCross-site request forgery is an attack in which a victim's authenticated browser is induced to send an unintended request.
• state parameterAn opaque client-generated OAuth value that binds an authorization response to the initiating request.
• schema validationSchema validation is the checking of data against a defined schema's fields, types, structure, and constraints.
• zero-day vulnerabilityA zero-day vulnerability is a security flaw for which no known fix is available.
• infrastructure as codeInfrastructure as code is the management of infrastructure through machine-readable code rather than exclusively through manual configuration.
• EC2 metadata serviceThe EC2 metadata service is a locally accessible service that provides metadata and credential-related information for an Amazon EC2 instance.
• IMDSv2IMDSv2 is version 2 of the Amazon EC2 Instance Metadata Service protocol, which requires a session token for metadata requests.
• webhookA webhook is an HTTP callback that delivers event notifications to a user-specified URL.
• velocity checkA velocity check analyzes the speed and frequency of operations across contextual factors such as IP address, geolocation, device fingerprint, account, and resources.
• outbound proxyAn outbound proxy is an intermediary that monitors or mediates requests sent from an application to external services.
• client credentials grant typeThe client credentials flow is an OAuth authorization flow in which a client authenticates with its own credentials to obtain an access token without user interaction.
• circuit breaker patternA circuit breaker pattern prevents repeated calls to an unhealthy dependency and returns a controlled result when that dependency fails or responds unexpectedly.
• output sanitizationOutput sanitization is the cleaning or encoding of data produced by an external or untrusted source before it is processed, stored, or rendered.
• key thumbprintA key thumbprint is a compact hash-derived identifier for a cryptographic key representation.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.