REST API Design, Development &
Management
Session 5: API Security
Session 5: API Security
Basic authentication
Token based authentication
Key secret based authentication
API Authorization using OAuth
REST API Design, Development & Management
Recap of API Specification
Q&A
REST API Design, Development & Management
Let’s do the exercise together
● Mini applies for a credit card
● The credit card application have the following attributes: applicant_name*, application_date*, age, salary, status
(approved, rejected)
● On successful application a new credit card account got created (account attributes are: id*, credit_limit*,
available_limit*, account_holder_name*, status* (approved, rejected) ) and a new credit card issued.
● Mini loves to use her new credit card to shop online.
● Every credit card transaction will have the following attributes: transaction_id*, amount*, date*, transaction_type*
(credit, debit), remarks.
● 5th day of every month her statement/bill gets generated. Statement have attributes like: statement_date*,
due_date*, bill_amount*, min_due*.
And the tasks are
1. List all the resources this problem statement can have.
2. Create a new API specification document for this problem statement
a. First define all meta information
b. Second, define all resources/Models
c. Third, define paths for CRUD operations of the following: Credit Card Application,
Credit Card Account, Transaction, Credit Card Statement.
i. Every path should contain: summary, description, tags, parameters (if any),
request, responses (200, 401, 404, 422)
REST API Design, Development & Management
Let’s see an example of custom headers
REST API Design, Development & Management
Introduction to API Security
REST API Design, Development & Management
Application Security
Gateway
REST API Design, Development & Management
Mobile Banking Application
7. Secure Data
6. Transaction
authorised?
5. Who is the
caller of API?
1. Data Theft
2. Data Manipulation
3. Identity Theft
4. DOS attack
REST API Design, Development & Management
Data Security
Data
Protection Integrity
Data at rest(currently present in databases) is outside the scope of REST API
Data in Motion: In the scope for REST API
REST API Design, Development & Management
API Security
Authentication
Authorization
Functional Attacks
REST API Design, Development & Management
Basic Authentication
REST API Design, Development & Management
Basic Authentication
● Base64 Encoded
● User: Password
HTTP Header
Authorization: Encoded-Creds
API Consumer
HTTP Header
200 OK
401 Unauthorized
REST API Design, Development & Management
Basic Authentication Weakness
{Cre
dent
ials}
Credentials on
Phone
api.cowin.gov.in
}
entials
{ Cred
3rd Party apps and
websites HTTP
{Clear text credentials}
REST API Design, Development & Management
Summary of Basic Authentication
Basic Authentication
● Uses basic HTTP Header Authorization.
● Required credentials to be passed in every requests.
● Must be used with HTTPS.
REST API Design, Development & Management
Basic Authentication is part
of standard HTTP
specification
ⓘ Start presenting to display the poll results on this slide.
Which header is used for
Basic Authentication?
ⓘ Start presenting to display the poll results on this slide.
Which one is used in the
Authorization header for
Basic Authentication?
ⓘ Start presenting to display the poll results on this slide.
What are the issue(s) with
Basic Authentication
ⓘ Start presenting to display the poll results on this slide.
The encoding of credentials
in Basic Authentication is:
ⓘ Start presenting to display the poll results on this slide.
You MUST use HTTPs (TLS)
with Basic Authentication?
ⓘ Start presenting to display the poll results on this slide.
Reason for using HTTPs in
ⓘ Start presenting to display the poll results on this slide.
HTTP status code ______ is
sent back from basic auth in
case of failure
ⓘ Start presenting to display the poll results on this slide.
Token Based Authentication & JWT
REST API Design, Development & Management
Token Based Authentication
/token {Credentials}
3rd Party apps and
websites
{Token} api.cowin.gov.in
{Token}
/resource {Token}
REST API Design, Development & Management
Tokens?
Encoded string
● Hashing or private key for encryption.
Eliminates the need of sessions on API
● HTTP Header
● Query Parameters
● Request Body
Issuer can control the validity
● Expiry
● Revocation
REST API Design, Development & Management
JSON Web Tokens
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIx
MjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0Ij
oxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf3
6POk6yJV_adQssw5c
Base64 Base64
Payload
Header Signature
(Registered/Public/Private Claims)
REST API Design, Development & Management
JWT - Header
Header eyJhbGciOiJIUzI1NiIsInR5cCI
6IkpXVCJ9
Type
{
● “JWT” "alg": "HS256",
Base64 "typ": "JWT"
}
Hashing Algorithm
● “HS256”
● “HMAC”
● ...
REST API Design, Development & Management
JWT - Payload eyJzdWIiOiIxMjM0NTY3ODkwIiwibmF
tZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE
2MjM5MDIyfQ
Payload
(Registered/Public/Private Claims)
{
"sub": "1234567890",
"name": "John Doe",
Base64
"iat": 1516239022
}
Registered Public Private
● iss Issuer e.g. mybank.com ● name ● As agreed upon the
● exp Expiry timestamp ● email consumer &
● nbf Not before timestamp ● phone_number provider
● ... ● ...
REST API Design, Development & Management
JWT - Signature
SflKxwRJSMeKKF2QT
Signature
4fwpMeJf36POk6yJV_
adQssw5c
Hashed
Secret
Base64 Base64
Header + “.” + Payload
REST API Design, Development & Management
Summary of Token based Authentication
● Tokens are encoded string used for authentication
● Tokens may be set to expire
● Tokens may be revoked
REST API Design, Development & Management
Tokens are _________ strings
ⓘ Start presenting to display the poll results on this slide.
JWT stands for _______
ⓘ Start presenting to display the poll results on this slide.
Tokens need to be sent for
all resources that are
___________
ⓘ Start presenting to display the poll results on this slide.
Tokens may be sent by the
consumer in __________ depending
on the API implementation.
ⓘ Start presenting to display the poll results on this slide.
Following is NOT part of the
JWT token
ⓘ Start presenting to display the poll results on this slide.
Which part of JWT is not
base64 encoded?
ⓘ Start presenting to display the poll results on this slide.
Issuer can control the
validity of the tokens?
ⓘ Start presenting to display the poll results on this slide.
Claims are part of the :
ⓘ Start presenting to display the poll results on this slide.
Which one is not a type of
Payload/Claim
ⓘ Start presenting to display the poll results on this slide.
name, email, phone_number
are examples of __________
claim
ⓘ Start presenting to display the poll results on this slide.
Thank you!
See you tomorrow at 10AM
REST API Design, Development & Management
