1. What is REST API ?
A REST (Representational State Transfer) Server simply provides access to resources and the REST client accesses and presents the resources.
Resource is identified by URIs/ Global IDs.
REST uses various representations to represent a resource like Text, JSON and XML. JSON is now the most popular format being used in Web Services
REST is NOT
A Protocol
A Standard
Replacement of SOAP

2. How does a REST API Look like?

3. HTTP Methods GET (read) POST (create)(Not idempotent)
PUT (replace/update)
DELETE
PATCH (updating an existing resource)

4. HTTP Status Code 200 OK - Response to a successful REST API action.
204 No Content
400 Bad Request
401 Unauthorized
403 Forbidden
404 Not Found
405 Method Not Allowed
429 Too Many Requests (DOS due to rate limit)

5. Rest API Architecture

6. API Vulnerabilities

7. Authentication and Authorization
Common mistakes made during development phase:
HTTP Basic Authentication
HTTP Digest Authentication
Host: example.org
GET / HTTP/1.1
Authorization: Basic Zm9vOmJhcg==
GET /users/username/account HTTP/1.1
Host: example.org
Authentication: hmac username:[digest]

8. Cont... Cookie based Authentication
Resource :
Credentials : { "username": "myuser", "password": "mypassword" } {
"session":{"name":"JSESSIONID",
"value":"6E A9EB4AE501F" },

9. Mitigation Avoid Session based authentication
HTTP authentication over HTTPS
Oauth 1.0 (Fb app)
Oauth 2.0
API Keys

10. DoS (Denial of service) Reason : Lack of Rate Limiting

11. Cont.. Set Rate Limit to avoid DoS
User rate limits (Set with user API)
Server rate limits( Limit of specific Resource )
Regional data limits (Based on time and situation)

12. Service Information Leakage
Mitigation : -
Configure API properly
Hide server finger print

13. Cross-Site Scripting (XSS){
"code": "20025",
"title": "<script> alert('XSS'); </script>" }
Mitigation : -
Sanitize all Input Data
Use HTML special character encoding
White List input (Avoid Blacklisting)

14. CORS for REST APIs
CORS(Cross-Origin Resource Sharing) is a security mechanism that allows a web page from one domain or Origin to access a resource with a different domain (a cross-domain request).
Lack of CORS headers allow attacker to perform Cross-Site Request Forgery (CSRF).

15. Mitigation HTTP Response Code : HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET,POST,PUT
Access-Control-Allow-Origin: {
"token": "15d38683-a98f-402d-a373-4f81a " }

16. SQL Injections Input : http://petstore.com/api/v1/pet/123
Malicious Input :
Mitigation :
Sanitize user Input
White List input (Avoid Blacklisting)

17. HPP (HTTP Parameter Pollution)
Malicious Payload : security_token=attackertoken&blogID=attackerblogidvalue&blogID=vict imblogidvalue&authorsList=goldshlager19test%40gmail.com(attacker )&ok=Invite
Mitigation :
Server side parameter verification.

18. Avoid API Risk
Build API Security into Software Development and Deployment Processes
Validate User and App Identity
Encrypt the Message Channel
Monitor, Audit, Log and Analyze Your API Traffic