Downloaded 11 times
Uploaded bySoftware Guru
APIs y seguridad
This document discusses API security best practices. It recommends requiring authentication for APIs and responding only with minimal necessary information to prevent unintended disclosure. It also covers common attacks like denial of service, SQL injection, and predictable resource locations. The document advocates having knowledge of threats and using prevention techniques like throttling, input validation, and UUIDs for resources rather than integers.
More Related Content
![20260201 [FOSDEM] gomodjail - library sandboxing for Go modules.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20260201fosdemgomodjail-librarysandboxingforgomodules-260201225659-76609ec4-thumbnail.jpg?width=640&height=640&fit=bounds)
![谷歌留痕技术教程[ 𝙩𝙤𝙥 𝟮𝟯𝟯. 𝙘 𝙤𝙢 ]](https://cdn.slidesharecdn.com/ss_thumbnails/top233-260130173900-2eb784f9-thumbnail.jpg?width=640&height=640&fit=bounds)
APIs y seguridad
- 1. Enlighten your software ¿APIprimero? Seguridad primero: lo que necesitas saber para crear APIs seguras Fernando Perales
- 2.
- 3. Fernando Perales Software Engineer@ Crowd Interactive FLOSS Advocate /(.*) metal and 🍺 lover/ Passionate about web development and lean startup
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10. When to not APIfirst
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20.
- 21.
- 22. “REST's client–server separation ofconcerns simplifies component implementation, reduces the complexity of connector semantics, improves the effectiveness of performance tuning, and increases the scalability of pure server components.”
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 33. REST is an architectural style,not an standard
- 34. Considerations for APIs (and prettymuch, every system)
- 35.
- 36.
- 37.
- 38.
- 39.
- 40.
- 41.
- 42.
- 48.
- 49.
- 50. I'm not a bigcompany
- 51. Nobody will care aboutmy data
- 52. My API isnot public
- 53.
- 54.
- 55.
- 56.
- 57. Know what youare fighting
- 58.
- 59. OWASP WASC Web HackingIncidents Database Project
- 64.
- 65. An attempt tomake a machine or network resource unavailable to its intended users. https://en.wikipedia.org/wiki/Denial-of-service_attack
- 67.
- 68. Or legit users tryingto take advantage
- 70.
- 71.
- 73.
- 74.
- 77.
- 79.
- 80.
- 81.
- 82. ab -c 5-n 100 http://127.0.0.1:3000/login
- 83.
- 84. SQL injection isa code injection technique, used to attack data- driven applications, in which malicious SQL statements are inserted into an entry field for execution https://en.wikipedia.org/wiki/SQL_injection
- 85.
- 86. “SELECT * FROM usersWHERE userID='” + user_id +”‘”;
- 87. “SELECT * FROM usersWHERE usetID = ‘123’”
- 88.
- 89.
- 90. SELECT * FROM usersWHERE userID = ‘’ or ‘1’ = ‘1’
- 91.
- 92. An attack techniqueused to uncover hidden web site content and functionality. By making educated guesses, the attack is a brute force search looking for content that is not intended for public viewing. http://www.infosecpro.com/applicationsecurity/a54.htm
- 93.
- 94.
- 95.
- 96.
- 97.
- 98.
- 100.
- 101.
- 102.
- 103.
- 104. Letting unauthorized usersto access information they shouldn't
- 105.
- 106.
- 107.
- 108. How to deal withthis?
- 109.
- 110.
- 111.
- 112. API interactions from clientto server are still user input
- 113.
- 115.
- 117. NOTE: Does notwork anymore
- 119.
- 122. Charles can beused as a man-in- the-middle HTTPS proxy, enabling you to view in plain text the communication between web browser and SSL web server.
- 123.
- 125.
- 126.
- 127.
- 128.
- 129.
- 130.
- 131.
- 132.
- 133.