Uncategorized - API Security Blog

The API was not secure because the application code implementing it wasnt secure.

The incident highlights a number of key issues that organizations need to address when developing and deploying APIs: API security is critical, even if you think you dont have any real users ...

July 30, 2021

Im not a fan of the new sketchbook feature in Sketch.

I think it is a step back from what we had before, and I dont see any real benefit to using it over just having an artboard with your sketches on them. If you want to make changes later, you can alw ...

July 29, 2021

API keys are passwords.

Treat them as such. 3. Use a Secure Communication Channel The most common way to implement API security is through the use of HTTPS, which encrypts all traffic between users and the API endpoint usi ...

July 29, 2021

If youre using an API, make sure that it has rate limiting enabled.

Rate Limiting for the Win! So how do we prevent these issues? The first step is to implement rate-limiting on your APIs. Rate limiting can be implemented in many ways: by IP address, by user agent (b ...

July 29, 2021

Companies are suffering more API attacks than ever, and companies remain as ill-prepared as ever.

The Salt Labs team today released the latest edition of the pioneering State of API Security report. The data, drawn from a combination of survey responses and empirical data from Salt Security cu ...

July 29, 2021

The main idea is to use the same approach as in my previous post, but instead of using a simple hash function for hashing the data, I will use a cryptographic hash function.

The advantage of this approach is that it allows me to check if two pieces of data are identical or not without actually having to store them both. This means that I can avoid storing duplicate copies ...

July 29, 2021

API security is a business imperative.

The API economy is growing at an unprecedented pace, and organizations are increasingly relying on APIs to drive innovation https://t.co/Eg46lu5tzq ...

July 29, 2021

Attackers can exploit API endpoints vulnerable to broken object level authorization by using the same data attributes that are used in web applications.

The following example shows how an attacker could use a stolen users ID and password to access their bank account: A malicious user steals a valid users credentials from a compromised website, ...

July 29, 2021