Whitelist allowable methods

We all know that REST services allow multiple methods for performing different operations on a resource. To avoid any kind of conflicts, RESTful services have to be developed and deployed to ensure that only correct methods are accepted for processing. Other methods automatically are made to get an appropriate error message. The key security attacks are detailed as follows:

  • Cross-site request forgery: Resources are being exposed by REST services to the outside, along with a well-designed API. It is crucial to protect PUT, POST, and DELETE request cross-site request forgery (CSRF). The standard protection approach is to use one of the token-based approaches. If there's any cross-site scripting (XSS) in our application, ...

Get Hands-On RESTful API Design Patterns and Best Practices now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.