API Security in Action

2 Secure API development

This chapter covers

• Setting up an example API project
• Understanding secure development principles
• Identifying common attacks against APIs
• Validating input and producing safe output

I’ve so far talked about API security in the abstract, but in this chapter, you’ll dive in and look at the nuts and bolts of developing an example API. I’ve written many APIs in my career and now spend my days reviewing the security of APIs used for critical security operations in major corporations, banks, and multinational media organizations. Although the technologies and techniques vary from situation to situation and from year to year, the fundamentals remain the same. In this chapter you’ll learn how to apply basic secure development ...