Securing REST APIs

Securing REST APIs Les Hazlewood Apache Shiro Project Chair CTO, Stormpath

Topics •  General API Best Prac:ces •  Statelessness •  Authen:ca:on •  Authoriza:on (access control)

General REST API Best Prac=ces •  Base URL •  Integer Version •  HTTP vs HTTPS •  Nice Error Representa:ons

Base URL + Version hHps://api.stormpath.com/v1

Error Representa=on •  HTTP Status Code •  Applica:on-‐speciﬁc Error Code (18 4xx, 6 5xx) •  End-‐user Message •  Developer Message •  More Info URL

Error Representa=on Example HTTP/1.1 404 Not Found { "status": 404, "code": 404, "message": "Oops! That applica:on cannot be found.", "developerMessage": "The speciﬁed Applica:on cannot be found. If you accessed this url via a stale href reference, it might be helpful to acquire the tenants Applica:on Collec:on Resource to obtain the current list of applica:ons.", "moreInfo": "hHp://www.stormpath.com/docs/errors/404" }

Statelessness •  No sessions! Session clustering (and all that it implies) •  How do you prevent sessions? Your code? Framework code?

NoSessionCreationFilter[main]…[urls]/v1/** = noSessionCreation, authcBasic, …

Authen=ca=on •  What is safe? •  SSL – server vs client •  Username/Password, BASIC authen:ca:on •  API Keys •  What is OAuth?

HTTP Basic Authen=ca=on [main]…[urls]/v1/** = ssl, noSessionCreation, authcBasic,…

OAuth •  Protocol •  Designed for 3 par:es, can be used for 2 •  1.0a vs 2.0 •  Signature algorithm (HMAC) •  Shiro & Scribe

Authoriza=on •  Filter •  Excep:on handling

HEpMethodPermissionFilter [main]rest = org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter[urls]/v1/user = noSessionCreation, authcBasic, rest[user]/v1/** = noSessionCreation, authcBasic

Excep=on Handler •  Annota:on or asser:on •  MVC framework or JSP ‘catch all’ à JSON @RequiresPermission public void doSomething() { …} subject.checkPermission(“user:read”);

Securing REST APIs

by Claire Hunsaker

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Securing REST APIs Presentation Transcript