{"id":1076,"date":"2020-05-30T11:03:06","date_gmt":"2020-05-30T10:03:06","guid":{"rendered":"https:\/\/42crdev.prexihost.com\/?p=1076"},"modified":"2023-02-15T15:58:35","modified_gmt":"2023-02-15T15:58:35","slug":"tutorial-api-conformance-scan","status":"publish","type":"post","link":"https:\/\/staging2022.42crunch.com\/tutorial-api-conformance-scan\/","title":{"rendered":"API Security Testing with API Scan"},"content":{"rendered":"\n\n\t<p>Tutorials<\/p>\n\n\t<section>\n<p>We are going to show you how to perform a conformance scan on our platform. You can also perform an API Scan in VS code IDE \u00a0(<a href=\"https:\/\/platform.42crunch.com\/login\" target=\"_blank\" rel=\"noopener\">platform registration<\/a> is required). You can register for free. \u00a0<a href=\"https:\/\/staging2022.42crunch.com\/api-conformance-scan\/\">API Scan<\/a> is a dynamic runtime testing tool that simulates real traffic to your API to ensure conformance with the OpenAPI contract and identify security vulnerabilities.<\/p>\n<\/section>\n\t<iframe src=\"https:\/\/player.vimeo.com\/video\/789648704?h=24ce8054fc&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe>\n<h2>\n\t\tDynamic Testing\n\t<\/h2>\n\t<p>API Contract Conformance Scan is a dynamic runtime analysis of your API to check that the behavior of the API conforms to the contract it advertises in its OpenAPI (formerly known as Swagger) definition.<\/p>\n<p>You can run a scan on an API you have imported to 42Crunch Platform and deployed to find out if there are any mismatches between the API definition describing your API and what it actually does. If Conformance Scan testing finds any discrepancies, it reports the issues clearly so that you can fix them.<\/p>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2022\/04\/conf-dash-Custom-1024x519.png\" alt=\"conf-dash (Custom)\" itemprop=\"image\" height=\"519\" width=\"1024\" title=\"conf-dash (Custom)\" onerror=\"this.style.display='none'\"  \/>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2022\/04\/wizard-Custom-1024x511.png\" alt=\"wizard (Custom)\" itemprop=\"image\" height=\"511\" width=\"1024\" title=\"wizard (Custom)\" onerror=\"this.style.display='none'\"  \/>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2022\/04\/crunching-1-Custom-1024x375.png\" alt=\"crunching-1 (Custom)\" itemprop=\"image\" height=\"375\" width=\"1024\" title=\"crunching-1 (Custom)\" onerror=\"this.style.display='none'\"  \/>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2022\/04\/scan-complete-Custom-1024x377.png\" alt=\"scan-complete (Custom)\" itemprop=\"image\" height=\"377\" width=\"1024\" title=\"scan-complete (Custom)\" onerror=\"this.style.display='none'\"  \/>\n<h2>\n\t\tAuthentication in Conformance Scan\n\t<\/h2>\n\t<section>\n<p>If you have defined security requirements in your API, Conformance Scan must provide the information to fulfill those requirements when it sends requests to the API. When you configure the scan, you must therefore fill in the details that Conformance Scan can use to authenticate.<\/p>\n<p>The configuration wizard shows the security requirements defined on the root level in the OpenAPI (Swagger) definition of your API in a drop-down list. Each line on the list corresponds to a security requirement in the API definition, and the text lists the names of the security schemes and their types in that security requirement.<\/p>\n<p>Now 42Crunch fuzzes the OpenAPI (Swagger) file by sending it requests outside of the contract: different paths, different verbs, different transports, different parameters. Each and every one of these requests are not compliant with the contract, and SHOULD get rejected.<\/p>\n<p>In this particular case 61 requests that were invalid did not get rejected. All of these discrepancies are potential vulnerabilities that we were not aware of. So, the backend code somehow still works with these inputs that are not valid. Typically APIs are tested for scenarios within the design of the API &#8211; by fuzzing outside of the contract, we are able to find unknown vulnerabilities that could have led to a data breach.<\/p>\n<\/section>\n<h2>\n\t\tScan Report\n\t<\/h2>\n\t<section>\n<p>Conformance Scan produces a scan report that provides valuable information on how well your API conforms to its API definition. The report summarizes what was scanned and how the scan went, including the API&#8217;s response times, the received HTTP status codes, as well as any unexpected response status codes and their reasons. Clicking a found issue provides further details on it.<\/p>\n<\/section>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2022\/09\/Scan-UI-for-Solution-2.png\" alt=\"Scan-UI-for-Solution 2\" itemprop=\"image\" height=\"1080\" width=\"1562\" title=\"Scan-UI-for-Solution 2\" onerror=\"this.style.display='none'\"  \/>\n<h2>\n\t\tTry API Scan for Free\n\t<\/h2>\n\t<ul>\n<li>Dynamic runtime testing that simulates real traffic to your API.<\/li>\n<li>Tests conformance to the audited OpenAPI Contract.<\/li>\n<li>The instant report provides automated and guided fixes in-line with code.<\/li>\n<\/ul>\n\t\t\t<a href=\"https:\/\/platform.42crunch.com\/login\" target=\"_blank\" role=\"button\" rel=\"noopener\">\n\t\t\t\t\t\t\tRegister Now\n\t\t\t\t\t<\/a>\n\n","protected":false},"excerpt":{"rendered":"<p>An overview of API Scan, how to generate the security report that detects security misconfigurations between your API and the API definition<\/p>\n","protected":false},"author":4,"featured_media":12267,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"API Scan explained | API Security Testing ","_seopress_titles_desc":"An overview of the API Scan, how to generate the security report that detects security misconfigurations between your API and the API definition","_seopress_robots_index":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"disabled","ast-hfb-above-header-display":"disabled","ast-hfb-below-header-display":"disabled","ast-hfb-mobile-header-display":"disabled","site-post-title":"disabled","ast-breadcrumbs-content":"disabled","ast-featured-img":"disabled","footer-sml-layout":"disabled","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"footnotes":""},"categories":[11],"tags":[22,16,25],"_links":{"self":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts\/1076"}],"collection":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/comments?post=1076"}],"version-history":[{"count":0,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts\/1076\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/media\/12267"}],"wp:attachment":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/media?parent=1076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/categories?post=1076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/tags?post=1076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}