Download as PDF, PPTX
Uploaded byAdam Englander
Practical API Security - Midwest PHP 2018
The document discusses practical API security and provides recommendations for securing APIs. It recommends implementing defense in depth with layers of security including transport layer security, rate limiting, authentication, data validation, encryption, logging, and access control. It then goes into more detail about how to implement specific security measures like replay prevention, rate limiting, authentication methods, message and response validation, encrypting data at rest and in transit, and logging recommendations.
More Related Content
Similar to Practical API Security - Midwest PHP 2018
![Don't Loose Sleep - Secure Your Rest - php[tek] 2017](https://cdn.slidesharecdn.com/ss_thumbnails/dontloosesleep-secureyourrest-170524214928-thumbnail.jpg?width=640&height=640&fit=bounds)
![php[tek] 2108 - Cryptography Advances in PHP 7.2](https://cdn.slidesharecdn.com/ss_thumbnails/phptek2108-cryptographyadvancesinphp7-180601213135-thumbnail.jpg?width=640&height=640&fit=bounds)
![php[tek] 2018 - Biometrics, fantastic failure point of the future](https://cdn.slidesharecdn.com/ss_thumbnails/phptek2018-biometricsfantasticfailurepointofthefuture-180601212954-thumbnail.jpg?width=640&height=640&fit=bounds)
![Build a bot workshop async primer - php[tek]](https://cdn.slidesharecdn.com/ss_thumbnails/buildabotworkshop-asyncprimer-phptek-170524154424-thumbnail.jpg?width=640&height=640&fit=bounds)
Practical API Security - Midwest PHP 2018
- 1. @adam_englander Practical API Security AdamEnglander, Software Architect iovation
- 2. @adam_englander Let's set someexpectations...
- 3. @adam_englander What are weprotecting against?
- 4.
- 5.
- 6.
- 7.
- 8. @adam_englander 4: XML ExternalEntities (XXE)
- 9.
- 10. @adam_englander Use defusedxml and defusedexpatto protect lib.xml
- 11.
- 12.
- 13.
- 14.
- 15. @adam_englander 9: Using Componentswith Known Vulnerabilities
- 16. @adam_englander PHP Resources • https://security.sensiolabs.org/ •roave/security-advisories package • https://github.com/FriendsOfPHP/security- advisories
- 17. @adam_englander 10: Insufficient Logging& Monitoring
- 18. @adam_englander How do weprovide that protection?
- 19.
- 20. @adam_englander Defense in Depth TransportLayer Security Rate Limiting/Replay Prevention Authentication Data Validation Data Encryption Logging Access Control
- 21. @adam_englander Defense in Depth TransportLayer Security Rate Limiting/Replay Prevention Authentication Data Validation Data Encryption Logging Access Control
- 22. @adam_englander Defense in Depth TransportLayer Security Rate Limiting/Replay Prevention Authentication Data Validation Data Encryption Logging Access Control
- 23.
- 24.
- 25. @adam_englander Defense in Depth TransportLayer Security Rate Limiting/Replay Prevention Authentication Data Validation Data Encryption Logging Access Control
- 26.
- 27. @adam_englander Determine Uniqueness ofRequest GET / HTTP/1.1 Accept: application/json
- 28. @adam_englander Determine Uniqueness ofRequest GET / HTTP/1.1 Accept: application/json X-Nonce: 5ed518e8c5c51a64638b2b50c192242d
- 29. @adam_englander Store that uniquevalue in a datastore so you can verify you don't see it again
- 30. @adam_englander Use the addfunction on the cache to prevent race conditions
- 31. @adam_englander Cache Example if ($token=== null) { throw new AuthorizationRequiredException(); } elseif (!$this->cache->add(hash('sha512', $token), 1, 10)) { throw new InvalidRequestException(); }
- 32. @adam_englander Use insert onunique index for RDBMS to prevent race conditions
- 33. @adam_englander Rate limiting requiresunique identification for restrictions
- 34.
- 35. @adam_englander Use the addand increment functions of the cache to prevent race conditions
- 36. @adam_englander Cache Example $key =sprintf("%s|root-post|%s", $userId, $timeSlice); $this->cache->add($key, 0, 1); $total = $this->cache->increment($key);
- 37. @adam_englander Use insert withunique index and update returning in RDBMS to prevent race conditions
- 38. @adam_englander Data stores canbe done in three ways.
- 39.
- 40.
- 41.
- 42. @adam_englander Defense in Depth TransportLayer Security Rate Limiting/Replay Prevention Authentication Data Validation Data Encryption Logging Access Control
- 43. @adam_englander Do not makeauthentication part of the body
- 44.
- 45. @adam_englander HTTP Basic Authentication Authorization:Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
- 46.
- 47. @adam_englander HTTP Bearer Authentication Authorization:Bearer mF_9.B5f-4.1JqM
- 48.
- 49.
- 50. @adam_englander What about neverrolling your own crypto?
- 51.
- 52. @adam_englander No auth servicerequired
- 53. @adam_englander Can use existingJWT libraries to create and validate
- 54. @adam_englander Can be extendedbeyond auth to provide data validation and MITM protection
- 55. @adam_englander Defense in Depth TransportLayer Security Rate Limiting/Replay Prevention Authentication Data Validation Data Encryption Logging Access Control
- 56.
- 57.
- 58. @adam_englander Method Validation GET /user/abcHTTP/1.1 Accept: application/json
- 59. @adam_englander Method Validation DELETE /user/abcHTTP/1.1 Accept: application/json
- 60. @adam_englander Path Validation GET /user/abcHTTP/1.1 Accept: application/json
- 61. @adam_englander Path Validation GET /user/defHTTP/1.1 Accept: application/json
- 62. @adam_englander Body Validation PATCH /user/abcHTTP/1.1 {"email": "valid@user.com"}
- 63. @adam_englander Body Validation PATCH /user/abcHTTP/1.1 {"email": "pwned@hkr.com"}
- 64.
- 65. @adam_englander Status Code Validation HTTP/1.1200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 {"expected": "value"}
- 66. @adam_englander Status Code Validation HTTP/1.1400 Invalid Request Content-Type: application/json; charset=UTF-8 Content-Length: 21 {"expected": "value"}
- 67. @adam_englander Status Code Validation HTTP/1.1200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 {"expected": "value"}
- 68. @adam_englander Status Code Validation HTTP/1.1301 Moved Content-Type: application/json; charset=UTF-8 Content-Length: 21 Location: https://bad.actor.com {"expected": "value"}
- 69. @adam_englander Header Validation HTTP/1.1 200OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 Cache-Control: no-cache {"expected": "value"}
- 70. @adam_englander Header Validation HTTP/1.1 200OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 Cache-Control: max-age=99999999 {"expected": "value"}
- 71. @adam_englander Data Validation HTTP/1.1 200OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 {"active": false}
- 72. @adam_englander Data Validation HTTP/1.1 200OK Content-Type: application/json; charset=UTF-8 Content-Length: 21 {"active": true}
- 73.
- 74. @adam_englander Defense in Depth TransportLayer Security Rate Limiting/Replay Prevention Authentication Data Validation Data Encryption Logging Access Control
- 75.
- 76. @adam_englander Use a structureformat that allows for in-place key rotation and nonce storage
- 77. @adam_englander COSE CBOR Object Signingand Encryption (COSE) Concise Binary Object Representation (CBOR)
- 78.
- 79.
- 80.
- 81.
- 82.
- 83. @adam_englander Log in astructured format for easier parsing
- 84.
- 85. @adam_englander Include all dataregarding state. Anonymize sensitive data.
- 86. @adam_englander Include origin datato identify bad actors.
- 87. @adam_englander Utilize tools likeELK or Greylog to aggregate logs
- 88. @adam_englander Determine anomalous conditions andalert on those conditions.
- 89. @adam_englander And now ademonstration...
- 90.