42CRUNCH BLOG


Questions Answered: Top API Security Issues Found During POCs


You had questions, and we’ve got answers!

Thank you for all the questions submitted on our “Top API Security Issues Found During POCs” webinar. Below is the replay and all the answers to the questions that were asked. If you’d like more information please feel free to contact us.

 

Top API Security Issues 
Found During POCs

Watch Webinar

Top API Security Issues Found 
During POCs Slide Deck

Download

 

 

Is there a way to add specific rules to the allowlist?

There are two things you can do today: one is annotating operations or an API so that no authentication checks are required. If the security section is present though, that will take precedence. You can also influence operations sensitivity to increase/decrease the points assigned to a problem. 

We are working on allowing users to specify a list of checks which must not be taken in account for scoring. They will still be reported but will not affect the score. The goal is that this is decided by the security team at the organization level.

 

What are the parameters in OpenAPI for the API firewall? How do you configure that?

The API Firewall directly interprets the OAS file contents.

 

I’m using the VS extension, but it fails every time since a path is not defined. Is there a way to still run tests even though there is no path defined?

Please open a ticket here, attaching the file if you can and we will fix that ASAP.

 

How do you do security testing on API driven applications via lambda functions for beginners in API security?

My recommendation would be to start with being familiar with OWASP Top10 project for API Security (https://apisecurity.io/encyclopedia/content/owasp/owasp-api-security-top-10.htm) and diving into the OWASP cheat sheets  attached to those issues. 

The threats mentioned in that OWASP list are independent from the implementation and therefore you will need to adapt the implementation recommendations to AWS Lambda. 

 

Try our security audit for free. If you want to see the whole platform in action, request a demo now!