Securing HTTP-based APIs
Page 1 of 8
This guidance provides advice on securing HTTP-based APIs. It is aimed at technical members of staff who are responsible for designing or building applications that offer an HTTP API. Note that you should conduct threat modelling tailored to your specific design to completely secure your HTTP-based APIs.
What is an HTTP-based API?
HTTP-based APIs enable communication between different software systems, often including third-party services, and can be used to access services and databases, manipulate data, or even handle user authentication and authorisation. They are a key component in the architecture of modern internet applications.
An API (application programming interface) is typically defined as a set of specifications (such as the format of HTTP requests sent to API endpoints) along with a definition of the structure of response messages, usually in JSON format. APIs can be used to receive some data, upload some data or control an action or system.
Threats to an API
Attackers can exploit weaknesses and vulnerabilities in APIs in a number of ways. For example, they could:
- use an insecure API endpoint to obtain sensitive data
- use an API to upload malicious code, and use this to exploit a system
- gain access to an API and then carry out an unauthorised action on the system (such as making unauthorised payments in a banking system)
- use an API to manipulate data that is already stored within the system
- conduct a denial of service attack by repeatedly polling an API endpoint
As HTTP-based APIs are shared outside of your organisation with the intent of making data or capability available, you should perform service-specific threat modelling to understand the relevant risks and threats.
