In this presentation, i speak about some basics actions to secure your API. Keeping in mind that an API remains a web application, without html/javascript, i will do a demo of SQL injection and then quickly review the OWASP top 10 application security risks. From there i zoom on authentication doing a focus on oauth2/OpenID Connect. Stepping to API Management, i deep dive on some features that can help us to secure our APIs.

1. Secure your API
From basics to beyond
2019 September

2. Alexandre Faria
@lusoalex
@lusoalex_
https://alexandrefaria.net

3. API everywhere

4. Paradigm shift

5. API as hacking target

6. Risk exposure

7. Identity thief

8. Service unavailable

9. Embarrassing media
coverage

10. Legal penalties

11. Basics actions...

12. HTTPS

13. Header

14. Source code

15. TOP 10

17. Identity Providers
Web Application Firewall
API Management

18. Authentication
Vs
Authorization
401 403

19. FIDO

20. captcha

21. Oauth2
Openid connect

22. Token

23. #1 : Client

24. #2 Resource Server

25. #3 Resource Owner

26. #4 Authorization
Server

27. Authorization Server
1: authorization code request
2: login form
3: code
4: Code
5: Code + client_secret
6: Token & Refresh Token
7: sessionId
Server Side: Code

28. Authorization Server
1: authorization code request + PKCE
2: login form
3: code
5: Code + PKCE + client_secret
6: Token & Refresh Token
Native: Code + PKCE

29. Authorization Server
1: authorization request
2: login form
3: token
SPA: Implicit
DEPRECATED

30. Authorization Server
1: authorization code request
2: login form
3: code + token
4: Code
5: Code + client_secret
6: Token & id_token & Refresh Token
7: sessionId
Hybrid: Code & Implicit

31. Authorization Server
1: authorization request
2: token
Server to Server:
Client Credentials

32. Authorization Server
1: authorization request
2: token
Highly trusted app:
Resource Owner Password
Credential

33. Authorization Server
1: authorization request
2: verifier code
5: poll
4: Authenticate + Code
3: Code
Device

34. Authorization Server
1: authorization request
2: User
validation
3: Polling token
Client Initiated Backchannel
Authentication
DRAFT openid

35. Authorization Server
1: code+PKCE flow (device_sso scope)
2: login form
3: code
5: Code + PKCE + client_secret
6: Tokens & device_secret
Native SSO
DRAFT openid
7: id_token + client_id + device_secret

36. Weak link?

37. Symetric vs Asymetric
HS vs RSA

38. redirect_uri

39. state

40. logout

41. How to improve?

42. Issuer

43. scope

44. audience

45. API Management

46. 1
2
3
4
5
6
Authorization Server
API Management

47. API Key

48. Limit (rate/quota)

49. CORS

50. Circuit Breaker

51. A/B Testing

52. Measure

53. Take away

54. ➢ https://jwt.io/
➢ https://www.owasp.org
➢ https://github.com/lusoalex/talk-api-security
➢ https://github.com/brendan-rius/c-jwt-cracker
➢ https://github.com/ojensen5115/jwtcrack
➢ https://medium.com/decathlondevelopers/api-security-e48
00de36ce

55. QUESTIONS?

56. Photos coming from https://unsplash.com/