Uncategorized - API Security Blog

The most important thing is to have a good understanding of the problem youre trying to solve.

If you dont know what it means for your users, how can you expect them to? If you want people to be able to understand your product, make sure they are in control and that they feel safe. You need ...

28 июля, 2021

If youre going to use an API, make sure it is properly secured.

What can we learn from this? The lesson here is that security must be built into the design of APIs and not just bolted on as a secondary feature. The fact that the information was exposed through a ...

27 июля, 2021

Were hiring.

We are looking for a Senior Software Engineer to join our team in New York City. We have an exciting opportunity that will allow you to work with some of the most talented and dedicated people in the ...

27 июля, 2021

Im not a fan of the new look.

I cant help but feel like this is an attempt to make it more hip and cool, which I think is a mistake. It used to be that if you wanted to know what was going on in the world, you would read The ...

27 июля, 2021

Broken function-level authorization is a similar issue.

Broken function-level authorization is when applications fail to limit sensitive functions to the authorized users. Unlike broken object-level authorization, this flaw refers specifically to when unau ...

27 июля, 2021

If you are using a function-level authorization flaw, attackers can use the same HTTP methods to perform sensitive actions on your API that they would normally be restricted from doing.

How do we prevent this? Heres how broken function level authorization is prevented: First, identify all of the functions in your application and classify them into three categories: admin (e.g., ad ...

27 июля, 2021

I’m a Senior Security Consultant at Imperva, and I’ve been doing web application security for over 15 years.

Here's my top 10 list of things that you can do to protect your website from attack: 1. Use HTTPS Everywhere (https://www.eff.org/https-everywhere) 2. Protect Your Cookies (https://blog.imperva.com/20 ...

27 июля, 2021

Protect API keys as you would any other sensitive credential.

3. Monitor and Log All API Activity Monitoring is critical to ensuring that APIs are operating properly, but its also important for security purposes. Monitoring tools should be able to detect susp ...

27 июля, 2021