Web Based APIs have become a powerful tool for reaching end users in an increasingly fragmented market. The emergence of public and private APIs have introduced new challenges in identity management and access control. Attend this session to get a crash course in Web APIs, the risks they introduce and the emerging standards that can make them safer to use (including OAuth 2 and Open ID Connect)

1. Understanding Identity in the World of Web
APIs
Ronnie Mitra
Principal API Architect - Europe
Layer 7 API Academy

3. API Management
virtual cloudon-premise

4. Connecting things

5. Connecting computer programs

6. … over the web

7. 2000 – ebay

8. 2000 – salesforce

9. 2006 – Amazon Web Services

10. Twilio or stripe
2007 - Twillio

11. Web APIs
Language Independent
APIs are constrained by the syntax of the web
Most API Design principles can be applied
Some design principles are unique to Web APIs

12. Web APIs
HTTP

13. Network Based APIs
HTTP
COAP MQTT
WebSocket?

15. Tunnel Style
URI Style
Hypermedia Style
Event Driven Style

16. Tunnel Style
Example: SOAP
• transport agnostic
• operation based
• binding documents (WSDL)

17. Tunnel Style
<RetrieveStudentRecords>
<StudentId>1213</StudentId>
</RetrieveStudentRecords>

18. URI Style
GET
PUT
POST
DELETE
+ URI

19. URI Style
GET /students/1232

20. Hypermedia Style

21. Hypermedia Style
• links
• templated input (forms)
• task based

22. {
links: [
link {href: ‘…’ rel: ‘list’},
link {href: ‘…’ rel: ‘add’}
]
collection: [
{link: {rel:'complete',href:‘…'},
id:42,
text:‘Record 42'
}
]
}

23. Event Driven Style
Example: WebSockets
• event based communication
• server initiated events
• full-duplex (websocket)

24. Ronnie,Mitra,UK

25. Established mechanisms, tools and frameworks
HTTP and URI security mechanisms
Similar to URI style, new challenges with links
Starts in HTTP, need visibility in new protocol

27. Private/Partner or Closed APIs

28. Acme Corp.
API
Acme Corp.
App

30. Public or Open APIs

31. Acme Corp.
API
Third Party
App

33. Priority:
Lower Cost
Priority:
Increased Adoption

34. Focus on the developer experience
(dx)

35. Usability
Reliability
Simplicity
Security
Etc…
Software Qualities

36. DX > Software Qualities

37. Priority:
Lower Cost
Priority:
Increased Adoption

38. Innovation
Consumer Reach
Revenue Source
Marketing
Integration
Light Bulb designed by Jean-Philippe Cabaroc from The Noun Project

39. The API security challenge:
Balancing
Security and Usability

40. Identity
Authentication
Authorization
Availability
Integrity
Privacy

41. Identities and Attack Surfaces

42. Developer
Portal
API
Developer
End User
Administrator

43. Portal
API
Developer
End User
Administrator

44. API
End User

45. Injection Attack

46. API

47. Examples:
SQL Injection
Command Injection
Code Injection
Argument Injection

48. API Attack Example:
SQL Injection Attacks: APIs
GET http://host.com/aresource?token=
%E2%80%98or%20%E2%80%981%3D1
GET http://host.com/aresource?token=‘ or ‘1=1
select * from tokens where token = ‘’ or ‘1=1’;

49. APIs May Be A Direct Conduit
49
HTTP
Server
App
Server
Database
App
Objects
Often:
• Self-documenting
• Closely mapped to object space

50. SQL Injection Attack - Mitigation
Sanitize inputs
Validate request and response data
Limit data size

51. Denial of Service

52. API

53. Examples:
XML/JSON Parser Attacks
Jumbo Messages
Server Overload

54. Denial of Service Attack: Mitigation
Enforcement of boundary conditions
Intelligent rate limiting
Offload processing

55. Overflow

56. API

57. Buffer Overflow Attack: Mitigation
Boundary limit enforcement
Message validation

58. Cross Site Scripting

59. API

60. XSS API Example
60
Attacker
Web App Server
(browser+APIs)
Victim: Web
Browser
Client
<SCRIPT …>
1. API injects
script in
3. Browser loads
content with
embedded script
2. Server fails to
perform FIEO: Filter
Input, Escape Output
API

61. Cross Site Scripting: Mitigation
Whitelist tags if you can (i.e. where the validation space is
small and concise)
Blacklist dangerous tags like <SCRIPT>
Always perform FIEO (Filter Input, Escape Output)
Learn more: http://xssed.com
61

62. rate limiting is essential

63. we need message and payload validation too

64. is this new API world compatible with validation?

65. good APIs are extendable and evolvable

66. /myapi/v1
<contact>
<name>Ronnie</name>
<city>London</city>
</contact>

67. /myapi/v1
<contact>
<name>Ronnie</name>
<city>London</city>
<country>UK</country>
</contact>

68. <xs:complexType>
<xs:sequence>
<xs:element name=“name" type="xs:string"/>
<xs:element name=“city" type="xs:string"/>
</xs:sequence>
</xs:complexType>
<contact>
<name>Ronnie</name>
<city>London</city>
<country>UK</country>
</contact>

69. API
!

70. Man in the Middle

71. API

72.  Always use HTTPS
 Corollary: Use a secure HTTPS implementation
Man in the Middle Attack: Mitigation

73. App Spoofing

74. API

75.  Examples:
- Guessing application ID by brute force
- Retrieving application ID by sniffing traffic
- Cracking application to retrieve application ID
App Spoofing

76. how can I protect identity on a mobile device?

77. …?

78. what happens if my mobile app is impersonated?

79. API
End User

80. Revenue Source

81. What the Fudge*! I
didn’t make 10000
calls yesterday!!!!!!
I’m not paying that.
*This is what WTF actually stands for.

82. I didn’t buy 1000
mobile phones in
Russia!
I’m not paying that!

83. Forrester:
we are moving towards a ‘zero-trust’ model

84. New platforms, new languages, new challenges:
• Ruby on Rails
• Node.js
• Scala
• Nginx
• Squid/Varnish/Traffic Manager

86. TLS
OAuth 2
Open ID Connect

87. OAuth provides a
Delegated Authorization Framework

88. An imperfect analogy….

89. http://www.flickr.com/photos/drewleavy/5587005480

90. http://www.flickr.com/photos/24oranges/5791460046/

91. http://www.flickr.com/photos/grumbler/571106054/
http://www.flickr.com/photos/roboppy/238406811/
Your Money
This Shop Needs Your Money
You need to grant access
to your money

92. http://www.flickr.com/photos/drewleavy/5587005480
I won’t tell.
I promise!

93. www.flickr.com/photos/auntiep/255249516

94. Granting access to someone to act
on your behalf.

95. resolving the password anti-pattern

96. Your resources
This app needs to act on your behalf
You need to grant access
to your resources

97. Your google+ data
This app needs to access your
Google+ data
You need to grant access
to your resources

98. Hi Google.
I’d like to have access to a user’s
friends list.

99. Hang on, let me
ask…

101. He said yes. Here is your
access code.

102. “Client” == application
“Resource owner” == end-user
The first step to understanding OAuth 2:

103. OAuth 2 Grant Types
 Authorization Code
 Implicit
 Resource Owner Password Credentials
 Client Credentials

104. Authorization Code Grant
104
Client Application
Resource Owner
Using
Application
Resource Server
I Wish I could access
my resources through
this application…

105. Authorization Code Grant
105
Client Application
Resource Owner
Using
Application
Resource Server
…but I don’t trust this
app enough to give it
my credentials.

106. Authorization Code Grant
Initiation
106
Client Application
Resource Owner Authorization Server
Resource Server
User Agent
Issue GET
request via
User-Agent

107. Authorization Code Grant
Initiation
107
Client Application
Resource Owner Authorization Server
Resource Server
User Agent
Issue GET
request via
User-Agent
response_type
client_id
redirect_uri
scope
state

108. OAuth 2 Authorization Request
 response_type – indicates grant type
 client_id –application identifier
 redirect_uri (optional) – address which the UA can use to respond to client
 scope (optional) – space delimited string: what the client wants to do
 state (optional)– opaque string used to defeat CSRF attacks
 Sample Authorization GET URL:
https://azserver/oauth2/authorize?response_type=code&client_id=my_id&state=state&r
edirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcallback

109. Authorization Code Grant
Resource Owner Authentication
109
Client Application
Resource Owner Authorization Server
Resource Server
User Agent
Send
User
Authentication
Form
?
Authenticate

110. Authorization Code Grant
Authorization
110
Client Application
Resource Owner Authorization Server
Resource Server
User Agent
Deliver
Grant
Screen
???
Approve
Grant
Request

111. Authorization Code Grant
Receipt of Authorization Code
111
Client Application
Resource Owner Authorization Server
Resource Server
User Agent
Redirect
User-Agent
Client
Application
! Redirected
To
Client
Application
code
state
302

112. Authorization Code Grant
Access Token Request
112
Client Application
Resource Owner Authorization Server
Resource Server
Request
Access
Token
Return
Access
Token
and Optional
Refresh Token
grant_type
code
redirect_uri
client_id
200
AZ Code
AZ Code

113. Authorization Code Grant
Access Protected Resource
113
Client Application
Resource Owner Authorization Server
Resource Server
Request
Resource
Using
Application
Return
Resource
200

114. be careful – much can go wrong!

115. Authorization Code Grant
Initiation
115
Client Application
Resource Owner Authorization Server
Resource Server
User Agent
Issue GET
request via
User-Agent
response_type
client_id
redirect_uri
scope
state

116. Authorization Code Grant
Receipt of Authorization Code
116
Resource Owner Authorization Server
Resource Server
User Agent
Redirect
User-Agent
Client
Application
Redirected
To
Client
Application
code
state
302

117. is this complex?

118. is this too complex?
a better question:

119. is this too complex for our developers?
an even better question:

120. It depends, but it is the best we have today

121. 2 vs. 3 Legged Spectrum
121
Three
legged
Two
legged

122. Three Legged
122
Client ApplicationResource Owner
Authorization Server
Resource Server

123. Two Legged
123
Client Application
Authorization Server
Resource Server

124. OAuth 2 Challenges
It is a framework

125. OAuth 2 Challenges
It is complex for the implementer

127. OpenID Connect
 Identity Access
 Built on top of OAuth 2
 Not tied to any single vendor or identity provider

130. API
End User

131. API
End User
?

132. Client Application
Retrieve User
Information
OpenID
Resource
Server
id_token

136. Portal

137. Who is using the API?
How are they (mis)using it?

138. What would happen if the portal was exploited?

139. Portal
API
Developer
End User
API

140. Portal
API
Administrator

141. Where are the components deployed?
Who owns the identity store?

142. Portal
API
is this safe?

143. http://www.flickr.com/photos/naomi_pincher/3306312873/
Layered Pattern

145. Security Layer
TLS termination
OAuth and OpenID Connect support
Schema validation
Boundary enforcement
Cryptographic operations
Security mediation

147. API Gateway
Gateway
API
API

148. API Management
Portal
Gateway
API
API

149. Summary:
Old threats still exist
Be aware of new surfaces and threats
Enforce security in an abstracted layer with a gateway

150. www.apiacademy.co

151. Visit the Layer 7 booth for information
on our gateways and portals!