TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

API Security Checklist for developers

321 点作者 eslamsalem将近 8 年前

12 条评论

tptacek将近 8 年前
There&#x27;s some OK stuff here, but the list on the whole isn&#x27;t very coherent. If this is a guide specifically for &quot;APIs&quot; that are driven almost entirely from browser Javascript SPA&#x27;s, it makes sense. Otherwise, a lot of these recommendations are a little weak; for instance, most of the HTTP option headers this list recommends won&#x27;t be honored by typical HTTP clients.<p>Further, the list succumbs to the cardinal sin of software security advice: &quot;validate input so you don&#x27;t have X, Y, and Z vulnerabilities&quot;. Simply describing X, Y, and Z vulnerabilities provides the same level of advice for developers (that is to say: not much). What developers really need is advice about how to structure their programs to foreclose on the possibility of having those bugs. For instance: rather than sprinkling authentication checks on every endpoint, have the handlers of all endpoints inherit from a base class that performs the check automatically. Stuff like that.<p>Finally: don&#x27;t use JWT. JWT terrifies me, and it terrifies all the crypto engineers I know. As a security standard, it is a series of own-goals foreseeable even 10 years ago based on the history of crypto standard vulnerabilities. Almost every application I&#x27;ve seen that uses JWT would be better off with simple bearer tokens.<p>JWT might be the one case in all of practical computing where you might be better off rolling your own crypto token standard than adopting the existing standard.
评论 #14727548 未加载
评论 #14727880 未加载
评论 #14727515 未加载
评论 #14727516 未加载
评论 #14730250 未加载
评论 #14728760 未加载
评论 #14727531 未加载
评论 #14727687 未加载
Kiro将近 8 年前
&gt; Don&#x27;t use Basic Auth<p>Why not? If it&#x27;s an API meant to be consumed by a server I don&#x27;t see what the problem is.
评论 #14728067 未加载
tiffanyh将近 8 年前
I don&#x27;t bookmark many links but here&#x27;s [1] a good one for all to keep on a similar topic.<p>It&#x27;s a SO article on security for web transactions.<p>[1] <a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;549&#x2F;the-definitive-guide-to-form-based-website-authentication" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;549&#x2F;the-definitive-guide...</a>
moxious将近 8 年前
No amount of checklisting and best practices substitutes for hiring someone smart to break your stuff and tell you how they did it. You can check all the boxes and still get pwned.<p>You can learn and run automated tools for 6 months and end up knowing 1&#x2F;3rd of what a great pentester knows.<p>If you want to know you can resist an attack from an adversary, you need an adversary. If you want to know that you followed best practices so as to achieve CYA when something bad happens, that&#x27;s a different story.<p>But honestly the security picture is so depressing. Most people are saved only because they don&#x27;t have an active or competent adversary. The defender must get 1,000 things right, the attacker only needs you to mess up one thing.<p>And then, even when the defender gets everything right, a user inside the organization clicks a bad PDF and now your API is taking fully authenticated requests from an attacker. Good luck with that.<p>Security, what a situation.
评论 #14727805 未加载
评论 #14728890 未加载
bodhi将近 8 年前
What are peoples thoughts on using TLS client certificates for authentication?<p>Given we&#x27;re talking about APIs, we avoid many of the UX problems, but it feels like taking on a different set of problems than just using a bearer token. It does provide baked in solutions for things like revocation and expiry though.
评论 #14728812 未加载
评论 #14731586 未加载
评论 #14731596 未加载
评论 #14735220 未加载
drdaeman将近 8 年前
&gt; Always try to exchange for code not tokens (don&#x27;t allow response_type=token).<p>There is absolutely nothing wrong with the implicit flow if the application (including in-browser ones) is requesting the token for itself (and not for some server or any third party). In case of a standalone app that would be just an extra meaningless step.<p>There is a slight difference in presence&#x2F;absence of refresh token, though, but that would make implicit flow <i>more</i> secure (because, if standard-compliant, there won&#x27;t be any refresh tokens at all), not less.<p>In case of a browser, the token would end up in the browser&#x27;s history, but given that a) if browser itself is compromised game is already over, and b) that it&#x27;s not possible for other parties to access the history (besides some guesswork that doesn&#x27;t work for tokens), paired with a fact that c) such tokens should be short-lived, it&#x27;s not a big deal.<p>&gt; User own resource id should be avoided. Use &#x2F;me&#x2F;orders instead of &#x2F;user&#x2F;654321&#x2F;orders<p>This has absolutely nothing to do with security. TBH, I don&#x27;t see any issue if &#x2F;me&#x2F; would be a redirect or an alias for &#x2F;user&#x2F;654321&#x2F;. That may make perfect sense if a conceptual purity is desirable (&quot;for each object there is one and only one URL - the canonical one&quot;), with its pros and cons.<p>&gt; Don&#x27;t use auto increment id&#x27;s use UUID instead.<p>Similarly, that barely has anything to do with security. One just has to understand that sequential IDs are trivially enumerable (and an obvious consequence of this fact - that API consumers would be able to enumerate all the resources or, at the very least, estimate their cardinality).<p>And as for the security - it should&#x27;ve probably said UUIDv4, because if one accidentally uses e.g. UUIDv1 their IDs would lose the unguessability.
philip1209将近 8 年前
&gt; User own resource id should be avoided. Use &#x2F;me&#x2F;orders instead of &#x2F;user&#x2F;654321&#x2F;orders<p>Can somebody explain this?
评论 #14727722 未加载
评论 #14727850 未加载
评论 #14727591 未加载
评论 #14728545 未加载
评论 #14727602 未加载
ikeboy将近 8 年前
So I&#x27;m developing a simple SAAS with little to no private info and where failure isn&#x27;t critical.<p>For initial release I build a page that uses html buttons and basic javascript to GET pages, passes a key as a parameter, and uses web.py on the backend.<p>It seems like it would be a lot of work to implement the suggestions here. At what point does it make sense?
EGreg将近 8 年前
There is a lot more you can do.<p>For example you can sign session IDs or API tokens when you issue them. That way you can check them and refuse requests that present invalid tokens without doing any I&#x2F;O.
评论 #14728677 未加载
baybal2将近 8 年前
The guy forgets the main thing here: length, type and range checks!<p>I&#x27;m finding issues like API servers hanging&#x2F;crashing due to overly long or malformed headers all the time when I work on front-end projects.<p>Programming in a language with automatic range and type checks does not mean that you can forego vigilance even with the most mundane overflow scenarios: lots of stuff is being handled outside of the &quot;safe&quot; realm or by outside libraries.
ViktorasM将近 8 年前
Not a security topic, but POST is not necessarily &quot;create&quot; and PUT is not necessarily &quot;update&quot;.
评论 #14735237 未加载
kpcyrd将近 8 年前
I&#x27;ve filed a pull request to include a CSP technique I&#x27;ve started adding on some of my apis:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;shieldfy&#x2F;API-Security-Checklist&#x2F;pull&#x2F;5" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;shieldfy&#x2F;API-Security-Checklist&#x2F;pull&#x2F;5</a>