How To Build A Secure Open Source API Program

API security is one of the most important aspects of cybersecurity. The rise of new technologies like microservices, cloud-native applications, IoT devices, single-page applications, serverless, and mobile has led to increased use of APIs. Any internal application elements are now APIs connecting with one other through a network. 

A game API lets your applications and web services communicate with one another and share information such as rules, settings, specs, and data. These APIs are used to distribute and embed game content and interact with libraries, apps, operating systems, consoles, and more.

However, incorporating open APIs is a risky business and they are prone to many security attacks, compelling the developers to follow only best practices while designing the APIs. In short, API Security is equally important as functionality and agility. As a result, the mobile game app development sector wants to find ways so that implementing third-party APIs does not expose them to a security risk.

Why do you Need Powerful API Security?

• Most recently, in June 2021, hackers stole the source code of FIFA 21, the Frostbite engine, FIFA 21 matchmaking server, and FIFA 22 API keys from the gaming giant EA.
• 50% of the global security decision-makers had at least one breach in 2018
• In 2019, 540 million Facebook user records were exposed due to an unsecured API
• 1.1 Billion identities in India were at the risk of theft due to an unsecured API

Traditional web application firewalls (WAF) are unable to distinguish between valid and malicious API calls due to their manually specified deny and allow rules. All of their calls are simply GETs and POSTs with some JSON exchanged.

The popular anomaly detection solutions, Artificial Intelligence, and machine learning are also lagging when it comes to regulating APIs. AI and ML must be presented with a large amount of legitimate traffic to train the system. But with APIs, they have been found prone to false positives and negatives as they can't exactly explain why a specific call is "suspicious".

Using AWS for building a Secure Public API

AWS allows the developers two solutions for developing secure public APIs: fully managed or self-built. Furthermore, the developers have the choice to opt for developing REST APIs through Amazon API Gateway or GraphQL APIs via AWS AppSync under fully managed services. 

API Gateway controls traffic management, access and authorization, CORS support, bandwidth throttling, and management of API versions, as well as other responsibilities involved in accepting and processing hundreds of thousands of concurrent API calls. It makes it simple for developers to establish, publish, maintain, monitor, and protect APIs at any scale because it is fully managed. 

AWS AppSync makes developing GraphQL APIs simply by taking care of the tedious task of safely linking to data sources such as Lambda, AWS DynamoDB, and others. It's just as simple to add caches to boost performance, subscriptions to support real-time updates, and client-side data storage to keep off-line clients in sync.

You may also create your own API interface by using AWS components like Compute and Load Balancers. These building elements do not limit you from hosting as many open-source frameworks on AWS as you like. Building or hosting an open-source language-specific framework gives you more control to explore, but it also means you'll have to manage the infrastructure yourself.

They provide adequate security by integrating certificate management, user authentication, and SSL/TLS decryption with Amazon Virtual Private Cloud (VPC). They work together to give you the ability to manage TLS settings from a central location and offload CPU-intensive workloads from your applications. Furthermore, Open Source solutions S2N and HTTP Guardian have been developed to lessen the risk of HTTP-based assaults.

6 Best Practices for Building a Secure API

Many startups indulge in creating public APIs as a service. They may do so in order to get monetization, visibility, and engagement, all of which lead to growth. When creating an API, developers must handle a wide range of criteria. 

APIs can also be built in a variety of methods. Prioritizing critical needs and choosing the best implementation solutions can be difficult.

Nowadays, you can find readily available tools like Restlet Studio, Swagger, BlazeMeter among others that construct rapid APIs on top of databases. Front-end developers employ them to read and write data on the back-end. Of course, they tend to be missing proper access documentation.

This convenience could be counter-intuitive if an attacker learns that rather than calling a GET operation on a certain path (/admin), they can submit a DELETE or even a PUT, thus modifying your back-end database that was originally meant to be read-only.

1. Positive Security Paradigm

Companies are increasingly turning to the Positive Security paradigm to overcome this problem. They specify the intended API behaviour, ensuring that the definition is strict and precise enough to be useful, test the implementation to ensure that it adheres to the definition, and then enforce the definition during API use. Any requests that aren't in line with the API's expectations, as well as any responses that aren't in line with the API's expectations, are automatically refused.

APIs, unlike traditional applications, allow you to define your expected inputs and outputs in a machine-readable model. This contract format is OpenAPI, which is the most prevalent sort of API nowadays – REST APIs. Strictly describing the schema of such requests and responses contributes significantly to security.

It's critical to fully document all operations enabled by the API components like path, operations, parameters, and to refuse anything else.

For instance, API operations have various parameters such as:

• Path parameters, such as /users/{name}
• Query parameters, such as /users?role=admin
• Header parameters, such as X-MyHeader: Id
• Cookie parameters, such as Cookie: none; csrftoken=BWSe35dohU3O1ZvDCU

It's a good idea to define their syntax and limitations in full. Using a rigorous regular expression to lock the strings down to their specific pattern can protect you from Injection attacks. Even if not injection, you are oblivious to the functionality of your back-end code if something outside the intended range is sent. 

The severity of the situation can be gauged from the incident when the license generating API of Valve's Steam gaming service was discovered to have an API vulnerability. In essence, anyone with a developer portal account would be able to get the game activation keys for any other Steam-hosted game and sell or distribute them to pirates for use in other Steam games. Fetching from the API /partnercdkeys/assignkeys/ with an ambiguous key count like zero yielded a heap of activation keys.

Related topic: How JWT Helps in Securing Your API

2. API Blueprint for Documentation

API Blueprint allows you to swiftly prototype and design new APIs, as well as test and document imperative APIs that have already been deployed. Its purpose is to isolate API pieces to allow for modularity while encapsulating backend implementation activity.

API Blueprint reduces ambiguity among all stakeholders by offering tools to clearly document APIs, render documentation, and construct mock servers for testing and continuous development. Once the API Blueprint is in place, anyone may check to see if the implementation meets the contract's requirements.

But still, there are a lot of APIs that have been hacked. Researchers gained access to the backend intranet using the eSIM of a Mercedes-Benz E-Class-connected automobile in a recent incident. All they did was re-use APN settings, fake IMEI numbers, and locate and re-use certificates in order to connect. However, after they got over these roadblocks and were able to connect, they discovered that the APIs themselves were not protected in any way. 

Assuming that APIs are meant to be operating on the “inside,” and leaving them exposed within the network is a serious security flaw. All to and fro communication must be properly encrypted and authenticated.

3. Secure Connection

Another crucial step in securing an API is to make sure that only secure queries, such as TLS, are accepted (formerly known as SSL). End-to-end encryption protects all access credentials and API data in transit when communicating with a TLS certificate. Always utilise a security framework that is well-known and supported by a wide community.

4. Additional Security

Add an additional layer of protection by whitelisting allowed HTTP methods (such as GET, POST, and PUT) and banning by default those that you don't want anyone to use through a public API (like DELETE). Individual users should also be authenticated for specific tasks. For example, you might allow external users to run a single query but not the ability to export all data. 

Validate parameter-based query inputs. URL parameters, JSON request data, and XML input can all be changed by attackers. Fuzzers can wreak havoc on REST APIs with little input modifications, so be cautious.

5. API Management Tools

Not rolling your own REST API security is perhaps one of the most critical best practices. Use a security framework with policies to determine whether the inquiring party has access to the data.

New API management tools are being developed by a number of companies, ranging from start-ups to established suppliers. A growing number of vendors are releasing tools in this space for both runtime security management and design/development/test-time vulnerability identification. Most of the tools have prebuilt security scans for common issues like parsing and inappropriate data handling and check the code for such weaknesses.

You should also check the tool's capacity to work with the existing environment, as well as its ability to authenticate and retain state for DAST and API-specific attack vectors like those described in the OWASP API Top 10. Leading API testing tools will support a variety of authentication mechanisms, ranging from bearer tokens to OAuth2, and will automatically re-authenticate as needed during the security evaluation.

6. Make Time for Security Testing in Your Schedule

App developers must keep provision for security testing beforehand as it involves both time and money. While additional feature drives development, security testing should account for roughly 5% to 10% of the expenditure. As mobile games app developers utilize in-app purchases as a major monetization method, they are more vulnerable to API threats during transactions. All the access to mobile wallets or payment gateways must be through secure and trusted APIs.

Summing Up

It might be difficult to pick which APIs and third-party services to utilise while constructing technology, but if you don't use APIs, you'll have to rebuild a lot of functionality. Building APIs for your own service may also help your product get traction. So carefully select the correct partners and services, and you'll be well prepared for the future.

You will be shielded against 95% or more probable attacks if you follow the instructions in this article. However, keep in mind that OpenAPI is by large a developing standard, and its scope of API security is changing as well. Make the most of APIs, but make sure you check all the security boxes along the way.