What is API security?

Much of the modern Internet relies on APIs to function. API security is the process of protecting APIs from attacks and data breaches.

What is API security?

An application programming interface (API) allows one piece of software to interact with another. If a program or application has an API, external clients can request its services.

API security is the process of protecting APIs from attacks. As applications, networks, and servers can be attacked, APIs can fall victim to several threats.

API security is a core component of web application security. Most modern web applications rely on APIs to function, which introduces additional risk to an application by allowing outside parties to access it. One comparison is a business that opens its office to the public: having more people on the premises, some of whom may be unknown to the business’s employees, introduces greater risk. Similarly, an API allows outsiders to use a program, introducing more risk to the API service’s infrastructure.

What are some common API security risks?

• Vulnerability exploits: A vulnerability exploit is when an attacker sends specially crafted data at a target, data that takes advantage of a flaw in the target’s construction. These flaws, known as “vulnerabilities,” can give the attacker various unintended access to an API or its corresponding application. The Open Web Application Security Project (OWASP) maintains a list of the top 10 API vulnerabilities, such as SQL injection, security misconfiguration, and others. If an exploit targets a vulnerability that was previously unknown, this is called a zero-day threat — such threats are extremely difficult to stop.
• Authentication-based attacks: Clients must authenticate before making API requests so the API server does not accept requests from unknown or illegitimate sources. There are several ways to do this, but each is subject to compromise. For instance, an attacker could obtain a legitimate client’s credentials, steal an API key, or intercept and use an authentication token.
• Authorization errors: Authorization determines the level of access each user has. If authorization is not carefully managed, an API client may have access to data that should not be available, increasing the chance of a data breach.
• DoS and DDoS attacks: Too many requests directed at an API can slow or halt service for other clients. Some attackers will direct a glut of requests at an API on purpose in a denial-of-service (DoS) or distributed denial-of-service (DDoS) attack.

API security strategies can help mitigate these and other risks.

Strong authentication and authorization measures help ensure that data is not leaked and that only authorized clients make API requests. DDoS protection and rate limiting can shut down DDoS attacks. Schema validation and a web application firewall (WAF) can block vulnerability exploits.

How do rate limiting and DDoS mitigation help protect APIs?

Rate limiting limits how often someone can repeat an action within a certain timeframe. If an API client exceeds the number of allowed requests, rate limiting will discard or block further requests from them for some time.

DDoS mitigation helps stop DoS and DDoS attacks. In a DDoS attack, an attacker tries to overwhelm an API with a lot of requests in a short amount of time. Often, these requests come from multiple different sources.

Rate limiting and DDoS mitigation are crucial for APIs for a couple of reasons:

1. Stopping DoS and DDoS attacks. By blocking or dropping the extra requests, rate limiting and DDoS mitigation protects the API from becoming overwhelmed. Rate limiting alone may not stop low and slow DDoS attacks, but DDoS mitigation can absorb the extra traffic regardless.
2. Outside of intentional attacks, some clients may use an API too much. This costs the API service in terms of computing power, and it could slow service for other clients. Rate limiting helps prevent the API server from becoming overloaded.

How are vulnerability exploits blocked?

For a vulnerability exploit to work, the malicious API requests must be structured so that it causes the API to respond in a way its architects did not intend. There are several ways that API developers can block such malicious requests. Two of the most important to know are:

1. Schema validation
2. WAF rules

Schema validation

An API’s schema describes an API’s expected behavior: the kind of requests it should get and the kind of responses it should provide. Invalid requests that do not conform to this schema can cause an API to behave in unexpected ways, potentially resulting in a data leak. Schema validation identifies invalid requests and responses. By blocking invalid responses, API developers can avoid some types of attacks and help prevent data leaks.

Web application firewall (WAF) rules

A WAF works like a traditional firewall in that it blocks some network requests and responses and allows others through. It does this based on a set of rules: if a request or a response violates a rule, or conforms to a rule, it is blocked. A WAF is deployed in front of an API or a web application, and it monitors HTTP traffic.

It is possible to set up WAF rules that block request and response patterns that target a vulnerability. WAF rules can also block requests from certain IP addresses, which helps stop bot attacks and other attackers.

Why are authentication and authorization so important for API security?

Authentication ensures that API requests come from a legitimate source. Authorization lets the API server know if the requesting client is authorized to obtain requested data.

Suppose Alice constructs an API and Bob builds a web application that uses Alice’s API. When Bob’s application sends an API request to Alice’s API, he attaches a label that reads “this is from Bob” to the request. This authenticates Bob’s request so that Alice’s API server knows to treat the request as legitimate.

Alice’s API server also checks what privileges Bob has. If Bob’s request is for data that Alice’s API has labeled “Bob can see this,” the server fulfills the request. However, Alice’s API may have a section of data labeled “not for Bob,” and the server should not fulfill a request for that data when Bob is the requester. This is why authorization is important.

(In reality, Bob would attach a key or some other form of authentication to API requests, not just a label that says “this is from Bob.”)

There are several authentication methods for APIs. The most common ones are:

1. API key

The client is assigned a key — a unique string of characters that only they and the API service know. The key is attached to each API request. The API server checks for the key when it receives an API request to make sure it is from an authenticated client.

The downside of this authentication method is that if the key is stolen, an attacker can use it to impersonate a legitimate client and then carry out a variety of attacks. It is important to encrypt requests and responses to and from an API using an encryption protocol like Transport Layer Security (TLS)—that way, the key is not exposed in plaintext as it crosses the Internet.

2. Username and password

API requests can use typical username and password credentials for authentication via a method called HTTP authentication. In HTTP authentication, a username and password are encoded and added to the HTTP header for all API requests. The server can check these credentials against those of allowed clients to authenticate the requests.

This approach comes with all the challenges normally associated with passwords: passwords can be lost, leaked, stolen, guessed, or shared with untrusted parties. They are also subject to credential stuffing and brute force attacks, among other things.

3. OAuth token

Instead of requiring authentication directly from the client, an API server can get an authentication token from a trusted authentication server using the OAuth protocol. To use the API, a user logs in to a third-party service instead of directly logging in to the API. Like the username-and-password approach, this authentication method is vulnerable to credential stuffing and other attacks.

4. Mutual TLS (mTLS)

TLS is the encryption protocol that creates an encrypted, authenticated connection between client and server when loading webpages. TLS can also verify and authenticate both ends of an API connection.

In mutual TLS (mTLS), both client and server have a TLS certificate. They authenticate each other using these certificates, ensuring they are who they claim to be without relying on passwords or other authentication methods.

However, mTLS can be challenging to implement: all API endpoints and clients need legitimate TLS certificates, which may be difficult to enforce and maintain.