Securing API's

-

Securing APIs , every one talking about development of API using spring boot, python,.net,java...etc. but no  one talks about how to secure the APIS.

Here I'm talking about security in 5 ways

BASIC

This works by providing your credentials i.e userId and password works by setting "Authorization" request header with the value as Base64Encode(username:password)

curl -X GET \

http://localhost:8080/hellow \

-H 'Authorization: Basic a12dksl32weld2sdld3d2dsd='\

-H'Postman-Token:

30befeb9-83e4-46e8-8633-cf4ad2400936'\

-H 'cache-control:no-cache'

API KEY

Random string (e.g. UUID) is assigned to each API consumer

This key is passed either as query PARAM or as a request header

usually "X-API-KEY" is used as query PARAM or request header


curl -X GET \

http://localhost:8080/hellow \

-H 'Postman-Token:

30befeb9-83e4-46e8-8633-cf4ad2400936'\

-H 'X-API-KEY: 21312332133adada-1231asd-123a-123131312313' \

-H 'cache-control:no-cache'

Bearer Token

This involves giving access to the "bearer of the token" Normally we pass this in the "Authorization" request header with value as "Bearer<token>".

Bearer token scheme was originally created as part of OAuthr2.0

curl -X GET \

http://localhost:8080/hellow \

-H 'Authorization: Bearer 21231231daddadadadadadaadads'\

-H 'Postman-Token:

30befeb9-83e4-46e8-8633-cf4ad2400936'\

-H 'cache-control:no-cache'


TLS/Mutual TLS

TLS is a standard that keeps an internet connection private and checks that the data sent between client and a server, or a server and a client i.e whether it is encrypted and unmodified

Mutual TLS, also called as bi-directional TLS where both Client and Server validates the authenticity of each other.

Client Verifying the Server

The Server sends its digital x.509 certificate(and any intermediate certificates) to the client. The client verifies the server's certificate by using one of its pre-trusted root certificates. Most clients use the Microsoft or Mozilla set of trusted root certificates. At the end of ths process, the client knows the exactly who the server is.

Server verifying the client

The TLS handshake Certificate Request message is optionally sent by the server to the client. The certificate request message includes a list of distinguished names of root certificates that the server trusts.

It tell the client(DocuSign in our case) to respond with it own certificate and any needed intermediate certificates.

Comments

Post a Comment

Popular posts from this blog

Email Sending through O365 using OAuth Protocol

-
  Microsoft Office365 EWS servers have been extended to support authorization via the industry-standard OAuth 2.0 protocol. Using OAUTH protocol, user can do authentication by Microsoft Web OAuth instead of inputting user and password directly in application Microsoft / Office 365 OAuth + EWS We can use the OAuth authentication service provided by Azure Active Directory to enable our application to connect with IMAP, POP or SMTP protocols to access Exchange Online in Office 365. To use OAuth with our application we need to register application on Azure Active directory and other steps also we need to do to get the access token back. Below are the steps   To use Microsoft/Office365 OAUTH in your application, you must create an application in  https://portal.azure.com . Sign into the Azure portal using either a work or school account or a personal Microsoft account. If your account gives you access to more than one tenant, select your account in the top ...
Read more

IoT Technology

-
Image
IoT technology The Internet of Things (IoT) is a system of interrelated computing devices, mechanical and digital machines.  IoT is a network of sensors where data is exchanged, using different connectivity protocols, with systems. This set up can be leveraged to create a new business application or to enhance an existing process. The exchange of the data can be bi-directional between sensors and systems Examples of sensors can be temperature sensors, motion sensors, flow meters, heart meter monitors, biometric devices, smoke detectors, & etc Examples of connectivity can be wifi, radio, GPRS, GSM, LAN, WAN, & etc. Examples of systems can be a remote health monitoring applications, SCADA applications, etc Look at next slide about the complete flow of IoT process Examples A doctor in US would like to monitor the heart rate and ECG of a patient in Hyderabad. This is done with the patient having sensors attached to him that collect the ECG data and the hea...
Read more

What is reverse proxy?

-
Image
  What is a reverse proxy? A reverse proxy is a server that sits in front of web servers and forwards client (e.g. web browser) requests to those web servers. Reverse proxies are typically implemented to help increase  security ,  performance , and reliability . In order to better understand how a reverse proxy works and the benefits it can provide, let’s first define what a proxy server is. What’s a proxy server? A forward proxy, often called a proxy, proxy server, or web proxy, is a server that sits in front of a group of client machines. When those computers make requests to sites and services on the Internet, the proxy server intercepts those requests and then communicates with web servers on behalf of those clients, like a middleman. For example, let’s name 3 computers involved in a typical forward proxy communication: A: This is a user’s home computer B: This is a forward proxy server C: This is a website’s origin server (where the website data is stored) In a stand...
Read more