You're reading from Defending APIs

Product typeBook

Published inFeb 2024

PublisherPackt

ISBN-139781804617120

Edition1st Edition

Concepts

Cybersecurity

Author (1)

Colin Domoney

Securing Your Frameworks and Languages

In this chapter, we will discuss the core activity involved in converting an API design or specification into working code. This is where the rubber meets the road for API security—while having a well-designed API with security considered is essential, the running API will only be as secure as the implementation allows. As an API developer, it is essential that you understand the best practices for coding your API securely and using your frameworks and libraries in a secure manner.

Firstly, we will focus on the challenges of managing a design-first process, where you will learn how to manage the lifecycle of both your API specification and the underlying code implementing the API. Generating API code from the API specification automatically is a tenet of a secure design-first process, and you will learn how to use modern code-generation tools. Finally, we will examine best practices in your frameworks to ensure secure API implementations...

Technical requirements

For this chapter, you will need a development machine capable of the following:

Running Docker locally
Running VS Code with various marketplace extensions
Access to the internet and a GitHub account to access the examples

This chapter contains many code samples in various languages; these can either be run locally, which will require the installation of compilers, SDKs, and frameworks, or from within a Docker build container.

The example code and various breaking changes to the instructions can be found in the Chapter 10 folder on the book’s GitHub repository here: https://github.com/PacktPublishing/Defending-APIs/tree/main/Chapter10

Managing the design-first process in the real world

In Chapter 8, Shift-Left for API Security, we examined the concepts associated with design-first API development, namely that the API development team starts with the API design first (via an OpenAPI definition) and then proceeds to implement the API code. There are numerous benefits to adopting this approach, including the following:

Incorporating security early: Incorporating security early in the design lifecycle ensures that designers and developers are forced to consider how they will secure their APIs (for example, an OAS definition can be parsed to check if a security method has been specified and generate a warning if not). This makes it harder to leave security considerations for a later stage in the lifecycle.
Automated document generation: A well-formed OAS definition can be used to generate comprehensive API documentation for an API developer portal, making it easier for consumers to integrate with the API...

Using code-generation tools

In this section, we will deal with the practicalities of generating client and server code from an OAS definition using the two most popular tools currently in use:

Swagger Codegen (https://swagger.io/tools/swagger-codegen/)
OpenAPI Generator (https://swagger.io/tools/swagger-codegen/)

Swagger Codegen

Swagger Codegen (https://swagger.io/tools/swagger-codegen/) is part of the SmartBear API design and test tool suite. The product can be used within the SwaggerHub web portal or as a standalone command-line tool. The SwaggerHub portal offers a limited-time free trial, after which you can upgrade to various paid plans, but the command-line tool is made available free of charge.

Firstly, let us examine the capabilities of the SwaggerHub portal. Figure 10.2 shows a small OAS definition loaded into the editor window:

Figure 10.2 – Swagger Codegen user interface

The following areas are available to the...

Summary

This chapter focused on the critical topic of securing your languages and frameworks when developing APIs. Many of the most serious vulnerabilities we covered in this book originate from vulnerable code implementations or misconfigurations of frameworks. It is vital for the reader to understand the best practices for secure coding and safe framework usage.

First, we examined how to manage the design-first process in practice, covering the important topic of incorporating the OpenAPI definitions in the development lifecycle to ensure that the definition is the source of truth for the API and that all API code is derived from the definition. To do this, we examined two different code-generation tools: Swagger Codegen and the OpenAPI Generator. For the latter, we took a deep dive into understanding how to use it to generate secure server code stubs for various languages. As an API developer, you should become familiar with the fundamentals of generating server implementations...

Colin Domoney (BSc. MSc. CSSLP, CEH) is an API Security Research Specialist and Developer Advocate with deep expertise in the development of secure software. As VP of AppSec, he took on the challenge of securing software on a large scale and running the global AppSec program at Deutsche Bank. At Veracode, as an evangelist, he produces countless webinars, and blog posts, and speak globally at conferences. Currently, he has embraced the challenge of securing APIs with 42Crunch where he has produced the API industry's first security maturity model and contributed to numerous webinars, talks, and blogs. Currently, he is working on the industry's first defensive API developer training course. He is also the curator of the APISecurity weekly newsletter.
Read more about Colin Domoney

Personalised recommendations for you

Based on your interests and search pattern

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.

BookAug 2023338 pages

Automotive Cybersecurity Engineering Handbook

This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.

BookOct 2023392 pages

Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.

BookAug 2023496 pages

Cloud Penetration Testing for Red Teamers

The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.

BookNov 2023298 pages

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.

BookSep 2023316 pages5

Burp Suite Cookbook

Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.

BookOct 2023450 pages

Building and Automating Penetration Testing Labs in the Cloud

This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.

BookOct 2023562 pages

Ethical Hacking Workshop

As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.

BookOct 2023220 pages

Windows Forensics Analyst Field Guide

This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.

BookOct 2023318 pages

Implementing DevSecOps Practices

This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.

BookDec 2023258 pages