This document discusses web APIs and REST APIs. It provides examples of common web APIs like weather, Google Maps, and Twitter APIs. It then discusses security concerns around REST APIs like data interception, DDoS attacks, and farming. It recommends using HTTPS, authentication, access control, and JSON Web Tokens (JWTs) for security. It also mentions the importance of format checking, strong business logic, and proper API design.

1. WEB API
Security
access
denied

2. Before we
begin

3. What?
Why?
How?

4. WEB API
Application Programing Interface
● Interface which has a set of functions
that allow programmers to access
specific features or data.
● Web API as the name suggests, is an API
over the web which can be accessed
using HTTP protocol.

5. Examples
Weather APIGoogle Map API Twitter API Cat API

6. REST API
Representational State Transfer
Two main responsibilities
● listen for requests sent by the client
side
● respond these requests with
appropriate data.
Request :
GET, PUT, POST and DELETE

7. REST API
more on
● Market is rapidly adapting to the modern
technologies of frontend frameworks in
focus.
● So Most of the Business logic is moving
towards cloud now.
● Almost everyone is providing API’s
today.
● Most importantly it is being used on web,
in mobile app and even on IoT devices.

8. Quiz Time

9. Which of these do you think is more Secure ?

10. Which one do you think is using HTTPS?

11. What?
Why?
How?

12. Data Interception
● Capturing Traffic and Data
● Modifying Data
● Users are not who they are.

13. DOS Attacks
● Bunch of connections (slaves) to
point massive load towards a REST
API Endpoint.
● Main Objective is to make the
service unusable.
● Avoiding requests from uninvited
users is very important

14. Farming
● Scraping Data from someone else’s
API
● Preventing farming is important so
that no unnecessary data is being
transmitted
● Unnecessarily overloaded API call

15. What?
Why?
How?

16. Use HTTPS
● HTTP sends messages in cleartext
compared to HTTPS encrypted
messages.
● The website you are visiting is the
correctly certified website.

17. Do Authentication and
Access Control
● Using API Keys and Secrets for
Public API.
● Using Oauth or JWT for
Authentication
● Doing Access Control, like which
user, what role and what actions.
● Public API do request limiting based
on Pricing plan.
Project
API KEY
APP / WEBSITE
API Provider
Token Generator
Backend
User
Auth
Token

18. JWT
● JSON Web Tokens
● A self-contained solution to safely
transmit information between client
and server side.
● It decreases the load on the server
by a huge amount, and makes the
authentication process much faster

19. More on JWT
Header
{
"alg":“RSA256",
"typ":“JWT"
}
Payload
{
"token-type": "access-token",
"username": "snoopy",
"animal": "beagle",
"iss":
"https://demo.com/oauth2/token",
"scopes": [“twitter”, "mans-best-
friend"],
"exp": 1474280963,
"iat": 1474279163,
"jti": "66881b068b249ad9"
}
DTfSdMzIIsC0j8z3icRdYO1GaMGl6j
1I_2DBjiiHW9vmDz8OAw8Jh8DpO
32fv0vICc
0hb4F0QCD3KQnv8GVM73kSYaO
EUwlW0k1TaElxc43_Ocxm1F5IUNZ
vzlLJ_ksFX
GDL_cuadhVDaiqmhct098ocefuv0
8TdzRxqYoEqYNo
Signature
RSA256( base64UrlEncode( header ) + “.“ + base64UrlEncode( payload ) , secret )

20. Strong Business Logics
● Proper API Routes
● Doing Authentication in every Cloud
Functions.
● Good API Responses with HTTP
status codes

21. Format Checking
● Format checking is to validate the
content type being sent.
● Requests shall match the intended
content-type in the header.
● Strong Types, Length and Range
Validation, Request Size Limit and
Regular Expressions.