Secure API Design With OpenAPI Specification

Editor’s Note: The following is an article written for and published in DZone’s 2021 API Design and Management Trend Report.


API security is at the forefront of cybersecurity. Emerging trends and technologies like cloud-native applications, serverless, microservices, single-page applications, and mobile and IoT devices have led to the proliferation of APIs. Application components are no longer internal objects communicating with each other on a single machine within a single process — they are APIs talking to each other over a network.

API Security Weekly: Issue #17

This week, we are mostly discussing best practices and tools: the best methods to pass API keys and other sensitive data, tools that attackers use to discover APIs, and why API security is never set-and-forget.

Risks

Never put API keys or other sensitive information in URLs and query parameters. These are visible to browser extensions, server logs, browser history, shared links, and the referrer. Always use headers or POST method instead. See this article by Paris Mitton for details.