How to secure Web API?

Question

- What are the factors associated with security when it comes to Web API?
- How to handle security in Web API
- Show an example.

Rijwan Ansari · Accepted Answer

Hi, There are several factors: - First and foremost use authentication and authorization in webapi. You can use token/JWT role based, example: https://jasonwatmore.com/post/2019/10/16/aspnet-core-3-role-based-authorization-tutorial-with-example-api - Preventing Cross-Site Request Forgery (CSRF) Attacks. https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks - Apply CORS. - Authentication filter - Input/model validation filter - Maintain Session and so on.

Satya Karki · Answer

Hi Pranam,   I would suggest to use JWT authentication. Step by Step for ASP.NET core. https://jasonwatmore.com/post/2019/10/11/aspnet-core-3-jwt-authentication-tutorial-with-example-api    Additonally, you can use CORS. https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0

Sachin Singh · Answer

Currently, OAuth is widely used to secure a web API. (This means token-based Authorization)
Other methods are API key Auth:- where the client sends the API key and the web API after validating the key authorizes the request.
Basic Authentication/Windows (AD) also works for an intranet environment where the API is consumed within a local environment.
Go through my article on this
https://www.sharpencode.com/article/WebApi/authentication-and-authorization

Farhan Ahmed · Answer

https://www.imperva.com/learn/application-security/web-api-security/#:~:text=Securing%20your%20API%20against%20the,Connect%20are%20more%20secure%20alternatives.