Every REST API that is developed can be either open or protected. An open API has no limit regarding the number of clients requesting the resources. But most business APIs are protected. So, what are the important things to keep in mind about security? In the following list, we'll point out all the factors that should be taken care of to secure a REST API:
- Always use HTTPS to deliver the API Transport Layer Security (TLS).
- Rate limit the API by using user access tokens.
- Design various authentication and authorization roles on the API.
- Use public key/private key encryption to sign a JWT when the client and server are internal.
- Never store user credentials in plain files.
- Sanitize the URL query parameters; use a POST body for incoming requests.
- As we mentioned in the previous chapter, use an API Gateway for better performance and protection.
- Use...