API - Security

Post-Login Attacks

• Data, Application, System Attacks - APTs, Data Exfiltration, deletion
• API/Layer 7 DDoS Attacks

Pre-Login Attacks

• Authentication Service Attacks - credential stuffing, fuzzing, stolen cookies and tokens

Foundational API Security

• Access Control - tokens, Authentication, Authorization
• Rate Limiting - client throttling, quotas
• Network Privacy - TLS

Basic Access Authentication

is a method in which the user agent provides a user name and password when making a specific request

HTTP Authorization Header:

• Basic Scheme - credentials encoded in Base64 Notation (is not encryption)
• Digest Scheme - credentials encrypted with a cryptographic hash function

Token-Based Authentication

is a method that allow users to enter their username and password in order to obtain a token which allows them to make a specific request - without using their username and password. Once their token has been obtained, the user can offer the token - which offers access to a specific resource for a time period - to the remote site

HTTP Authorization Header:

• Bearer Scheme - credentials in a form of a token