3 years ago

Category: Database, Security, Data, github

As more and more data is exposed via APIs either as API-first companies or for the explosion of single page apps/JAMStack, API security can no longer be an afterthought. The hard part about APIs is that it provides direct access to large amounts of data while bypassing browser precautions.

This is dependent on your API use case and can even be dependent on their subscription with you.

The easiest way to secure against these types of attacks is by requiring a human to sign up for your service and generate API keys.

If your API is used only by your own apps or can only be accessed server-side, then review Authoritative guide to Cross-Origin Resource Sharing for REST APIs