Api Security

[cihataydin]

• Rate Limiting ve Throttling
  • Rate Limiting: Limit the number of requests allowed per user or IP within a specific time frame. This helps prevent malicious users from slowing down the API with spam.
  • Throttling: Restrict the number of requests within certain time intervals to reduce server load caused by excessive requests.
• Cross-Origin Resource Sharing (CORS) Restrictions
• SQL/NoSQL Injections
• Increase security with response header
  • Set X-Content-Type-Options to nosniff to prevent browsers from automatically detecting content types.
  • Set X-Frame-Options to DENY or SAMEORIGIN to prevent your site from being loaded in a frame by other sites.
  • Set Referrer-Policy to no-referrer to keep user information private.
  • Use Strict-Transport-Security (HSTS) to enforce HTTPS connections and protect against man-in-the-middle attacks. HSTS ensures that the server enforces HTTPS connections.
• Log Preservation: Logs should be stored in a secure environment to prevent attackers from erasing their traces and should only be accessible by authorized personnel.
• DNS Security: To ensure DNS security, consider using DNSSEC to protect against attacks such as DNS Spoofing. This secures DNS queries and prevents attackers from creating a fake DNS server to redirect API traffic.