Attackers want your data and they're getting it from your API - Tim Bond

Security

Learn how to fortify your APIs against threats, including using JSON Web Tokens and OAuth for authentication, and preventing attacks and protecting data.

Key takeaways

Attacker can get data by using an app’s API with a stolen key.
Using JWT (JSON Web Token) as auth method is better than static API keys.
Static API keys can be easily found in the source code or Decompiled Android apps.
API key can be used to bypass authentication and get access to user data.
OAuth is a good way to authenticate, but still vulnerable to attacks.
JWT tokens can be valid for a specific duration.
Consider using an exponential backoff to handle API rate limiting.
Limiting requests per timing window can prevent attacks.
Understanding the OWASP top ten is crucial for API security.
Using a rate limiter can help prevent attacks.
Tokens should be kept secret and not shared.
APIs should authenticate users and validate requests.
API keys should not be hardcoded or embedded in the app.
Using a proxy to mask API keys can help prevent attacks.
JWTs are susceptible to tampering and should be verified.
Using machine learning based solutions can help detect and prevent attacks.
Static API keys are easy to find and should not be used.
JWTs should be signed with a private key.
Using IP address as a protection method is not recommended.
Compromised API keys can lead to data breaches.
API authentication should be used in conjunction with rate limiting and IP blocking.
Custom proxy servers can be used to mask API keys.
JWTs should be used with caution and verified on both client and server sides.
API keys should not be shared or embedded in the app.
Tokens should be validated and verified on both client and server sides.
API keys can be used to bypass authentication and access user data.

Attackers want your data and they're getting it from your API - Tim Bond

More talks