SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Web API security</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Web API security</span></span>

</h1>

</header>

<p><b>Web API security</b> entails <a href="Authentication" title="Authentication">authenticating</a> programs or users who are invoking a <a href="Web_API" title="Web API">web API</a>.

</p><p>Along with the ease of API integrations come the difficulties of ensuring proper <a href="Authentication" title="Authentication">authentication</a> (AuthN) and <a href="Authorization" title="Authorization">authorization</a> (AuthZ). In a multitenant environment, security controls based on proper AuthN and AuthZ can help ensure that API access is limited to those who need (and are entitled to) it. Appropriate AuthN schemes enable producers (APIs or services) to properly identify consumers (clients or calling programs), and to evaluate their access level (AuthZ). In other words, may a <a href="Consumer" title="Consumer">consumer</a> invoke a particular method (business logic) based on the <a href="Credential" title="Credential">credentials</a> presented?

</p><p>"Interface design flaws are widespread, from the world of <a href="Cryptography" title="Cryptography">crypto</a> <a href="Central_processing_unit" title="Central processing unit">processors</a> through sundry

<a href="Embedded_system" title="Embedded system">embedded systems</a> right through to <a href="Antivirus_software" title="Antivirus software">antivirus software</a> and the operating system itself."<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Method_of_authentication_and_authorization">Method of authentication and authorization</h2></div>

<p>The most common methods for authentication and authorization include:

</p>

<ol><li>Static strings: These are like passwords that are provided by API's to consumers.</li>

<li>Dynamic tokens: These are time based tokens obtained by caller from an authentication service.</li>

<li>User-delegated tokens: These are tokens such as <a href="OAuth" title="OAuth">OAuth</a><sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> which are granted based on user authentication.</li>

<li>Policy & <a href="Attribute-based_access_control" title="Attribute-based access control">attribute-based access control</a>: policies use attributes to define how APIs can be invoked using standards such as <a href="ALFA_(XACML)" class="mw-redirect" title="ALFA (XACML)">ALFA</a> or <a href="XACML" title="XACML">XACML</a>.</li></ol>

<p>The above methods provide different level of security and ease of integration. Oftentimes, the easiest method of integration also offers weakest security model.

</p>

<div class="mw-heading mw-heading3"><h3 id="Static_strings">Static strings</h3></div>

<p>In static strings method, the API caller or client embeds a string as a token in the request. This method is often referred as <a rel="nofollow" class="external text" href="http://www.w3.org/Protocols/HTTP/1.0/spec.html#BasicAA">basic authentication</a>. "From a security point of view, basic authentication is not very satisfactory. It means sending the user's password over the network in clear text for every single page accessed (unless a secure lower-level protocol, like <a href="SSL_Proxy" class="mw-redirect" title="SSL Proxy">SSL</a>, is used to encrypt all transactions). Thus the user is very vulnerable to any <a href="Packet_sniffer" class="mw-redirect" title="Packet sniffer">packet sniffers</a> on the net."<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="Dynamic_tokens">Dynamic tokens</h3></div>

<p>When an <a href="Application_programming_interface" class="mw-redirect" title="Application programming interface">API</a> is protected by a dynamic token, there is a time-based <a href="Cryptographic_nonce" title="Cryptographic nonce">nonce</a> inserted into the token. The token has a time to live (TTL) after which the client must acquire a new token. The API method has a time check <a href="Algorithm" title="Algorithm">algorithm</a>, and if the token is expired, the request is forbidden. "An example of such token is <a href="JSON_Web_Token" title="JSON Web Token">JSON Web Token</a>. The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing."<sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="User-delegated_token">User-delegated token</h3></div>

<p>This type of token is used in three-legged systems where an <a href="Application_software" title="Application software">application</a> needs to access an API on behalf of a user. Instead of revealing user id and password to the application, a user grants a token which encapsulates users permission for the application to invoke the API.

</p><p>The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an <a href="Hypertext_Transfer_Protocol" class="mw-redirect" title="Hypertext Transfer Protocol">HTTP</a> service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Fine-Grained_Authorization_for_APIs">Fine-Grained Authorization for APIs</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Attribute-Based_Access_Control">Attribute-Based Access Control</h3></div>

<p>In this approach, there is a Policy Enforcement Point either within the API itself, in the API framework (as an interceptor or message handler), or as an API gateway (e.g. <a href="WSO2" title="WSO2">WSO2</a>, Kong, or <a href="API_management" title="API management">similar</a>) that intercepts the call to the API and / or the response back from the API. It converts it into an authorization request (typically in XACML) which it sends to a Policy Decision Point (PDP). The Policy Decision Point is configured with policies that implement dynamic access control that can use any number of user, resource, action, and context attributes to define which access is allowed or denied. Policies can be about:

</p>

<ol><li>the resource (e.g. a bank account)</li>

<li>the user (e.g. a customer)</li>

<li>the context (e.g. time of day)</li>

<li>a relationship (e.g. the customer to whom the account belongs).</li></ol>

<p>Policies are expressed in ALFA or XACML.

</p>

<div class="mw-heading mw-heading2"><h2 id="API_Security_for_AI_Factories">API Security for AI Factories</h2></div>

<p>In <a href="AI_Factory" title="AI Factory">AI factories</a>, API security is fundamental for protecting data integrity, managing access rights, and preventing malicious exploitation of interconnected systems. Robust strategies incorporate strong authentication (such as dynamic tokens), fine-grained authorization using policy-based controls, and continuous monitoring to safeguard against threats like data theft, model tampering, and service disruptions.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup> Ensuring that APIs are visible, tracked, and properly secured at every stage—from data ingestion to inference—helps maintain the integrity of machine learning processes and model outputs.<sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup> By aligning security measures with established methods (e.g., token-based or attribute-based access control), organizations can better protect both AI operations and sensitive assets in dynamic, multicloud, and hybrid environments.<sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c18.pdf">"API Attacks"</a> <span class="cs1-format">(PDF)</span>.</cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://oauth.net/2/">"OAuth 2.0 — OAuth"</a>. <i>oauth.net</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2015-10-10</span></span>.</cite></span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://unixpapa.com/auth/basic.html">"A Guide to Web Authentication Alternatives: Part 2"</a>. <i>unixpapa.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2015-10-10</span></span>.</cite></span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite id="CITEREFJohnNatMichael" class="citation web cs1">John, Bradley; Nat, Sakimura; Michael, Jones. <a rel="nofollow" class="external text" href="https://tools.ietf.org/html/rfc7519">"JSON Web Token (JWT)"</a>. <i>tools.ietf.org</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2015-10-10</span></span>.</cite></span>

</li>

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><cite id="CITEREFHardt" class="citation web cs1">Hardt, Dick. <a rel="nofollow" class="external text" href="https://tools.ietf.org/html/rfc6749">"The OAuth 2.0 Authorization Framework"</a>. <i>tools.ietf.org</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2015-10-11</span></span>.</cite></span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.f5.com/company/blog/api-security-for-ai-factories">"API Protection for AI Factories: The First Step to AI Security"</a>. <i>F5, Inc</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2025-01-30</span></span>.</cite></span>

</li>

<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><cite id="CITEREFModi2023" class="citation news cs1">Modi, Abhishek (2023-12-12). <a rel="nofollow" class="external text" href="http://web.archive.org/web/20240616084649/https://www.einfochips.com/blog/enhancing-api-security-with-artificial-intelligence-a-game-changer/">"Enhancing API Security with Artificial Intelligence: A Game Changer"</a>. <i>eInfochips</i>. Archived from <a rel="nofollow" class="external text" href="https://www.einfochips.com/blog/enhancing-api-security-with-artificial-intelligence-a-game-changer/">the original</a> on 2024-06-16<span class="reference-accessdate">. Retrieved <span class="nowrap">2025-01-30</span></span>.</cite></span>

</li>

<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://info.nmfta.org/cybersecurity-conference-2024/schedule/api-cybersecurity-in-the-ai-era">"API Cybersecurity in the AI Era"</a>. <i>info.nmfta.org</i>. 2024-10-28<span class="reference-accessdate">. Retrieved <span class="nowrap">2025-01-30</span></span>.</cite></span>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li><a rel="nofollow" class="external text" href="https://owasp.org/www-project-api-security/">OWASP API Security Project</a></li></ul>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Web_interfaces26" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div id="Web_interfaces26" style="font-size:114%;margin:0 4em"><a href="Web_API" title="Web API">Web interfaces</a></div></th></tr><tr><td colspan="2" class="navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><td class="navbox-abovebelow" colspan="2" style="font-weight:bold"><div id="Server-side154"><a href="Server-side" class="mw-redirect" title="Server-side">Server-side</a></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Communication_protocol" title="Communication protocol">Protocols</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="HTTPS" title="HTTPS">Encryption</a></li>

<li><a href="WebDAV" title="WebDAV">WebDAV</a></li></ul></li>

<li><a href="WebSocket" title="WebSocket">WebSocket</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Server_application_programming_interface" title="Server application programming interface">Server APIs</a></th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Netscape_Server_Application_Programming_Interface" title="Netscape Server Application Programming Interface">C NSAPI</a></li>

<li><a href="Apache_HTTP_Server#Feature_overview" title="Apache HTTP Server">C ASAPI</a></li>

<li><a href="Internet_Server_Application_Programming_Interface" title="Internet Server Application Programming Interface">C ISAPI</a></li>

<li><a href="Jakarta_Servlet" title="Jakarta Servlet">Jakarta Servlet</a>

<ul><li><a href="Web_container" title="Web container">container</a></li></ul></li>

<li><a href="HTTP_handler" title="HTTP handler">ASP.NET Handler</a></li>

<li><a href="Web_Server_Gateway_Interface" title="Web Server Gateway Interface">Python WSGI</a></li>

<li><a href="Asynchronous_Server_Gateway_Interface" title="Asynchronous Server Gateway Interface">Python ASGI</a></li>

<li><a href="JSGI" title="JSGI">JavaScript JSGI</a></li>

<li><a href="Java_Portlet_Specification" title="Java Portlet Specification">Portlet</a>

<ul><li><a href="Java_Portlet_Specification" title="Java Portlet Specification">container</a></li></ul></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="List_of_Apache_modules" title="List of Apache modules">Apache modules</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Server_Side_Includes" title="Server Side Includes">mod_include</a></li>

<li><a href="Mod_parrot" class="mw-redirect" title="Mod parrot">mod_parrot</a></li>

<li><a href="Mod_proxy" title="Mod proxy">mod_proxy</a></li>

<li><a href="Mod_python" title="Mod python">mod_python</a></li>

<li><a href="Phusion_Passenger" title="Phusion Passenger">Phusion Passenger</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Topics</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Web_service" title="Web service">Web service</a> vs. <a href="Web_resource" title="Web resource">Web resource</a></li>

<li><a href="Webhook" title="Webhook">Webhook</a></li>

<li><a href="Application_server" title="Application server">Application server</a>

<ul><li><a href="List_of_application_servers" title="List of application servers">comparison</a></li></ul></li>

<li><a href="Server-side_scripting" title="Server-side scripting">Scripting</a></li></ul>

</div></td></tr></tbody></table><div></div></td></tr><tr><td colspan="2" class="navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><td class="navbox-abovebelow" colspan="2" style="font-weight:bold"><div id="Client-side89"><a href="Client-side" class="mw-redirect" title="Client-side">Client-side</a></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Plug-in_(computing)" title="Plug-in (computing)">Browser APIs</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="NPAPI" title="NPAPI">C NPAPI</a>

<ul><li><a href="NPAPI#LiveConnect" title="NPAPI">LiveConnect</a></li>

<li><a href="NPAPI#XPConnect" title="NPAPI">XPConnect</a></li></ul></li>

<li><a href="NPAPI#NPRuntime" title="NPAPI">C NPRuntime</a></li>

<li><a href="Google_Native_Client#Pepper" title="Google Native Client">C PPAPI</a>

<li><a href="ActiveX" title="ActiveX">ActiveX</a></li>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Web_API#Client_side" title="Web API">Web APIs</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="row" class="navbox-group" style="width:1%"><a href="WHATWG" title="WHATWG">WHATWG</a></th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="HTML_audio" title="HTML audio">Audio</a></li>

<li><a href="Canvas_element" title="Canvas element">Canvas</a></li>

<li><a href="HTML_video" title="HTML video">Video</a></li>

<li><a href="WebSocket" title="WebSocket">WebSockets</a></li>

<li><a href="Web_Messaging" title="Web Messaging">Web messaging</a></li>

<li><a href="Web_storage" title="Web storage">Web storage</a></li>

<li><a href="Web_worker" title="Web worker">Web worker</a></li>

<li><a href="XMLHttpRequest" title="XMLHttpRequest">XMLHttpRequest</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="World_Wide_Web_Consortium" title="World Wide Web Consortium">W3C</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="DOM_event" title="DOM event">DOM events</a></li>

<li><a href="W3C_Geolocation_API" title="W3C Geolocation API">Geolocation</a></li>

<li><a href="Indexed_Database_API" title="Indexed Database API">IndexedDB</a></li>

<li><a href="WebAssembly" title="WebAssembly">WebAssembly</a></li>

<li><a href="WebAuthn" title="WebAuthn">WebAuthn</a></li>

<li><a href="WebGPU" title="WebGPU">WebGPU</a></li>

<li><a href="WebRTC" title="WebRTC">WebRTC</a></li>

<li><a href="WebXR" title="WebXR">WebXR</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Khronos_Group" title="Khronos Group">Khronos</a></th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="WebCL" title="WebCL">WebCL</a></li>

<li><a href="WebGL" title="WebGL">WebGL</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Others</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Gears_(software)" title="Gears (software)">Gears</a></li>

<li><a href="Web_SQL_Database" title="Web SQL Database">Web SQL Database</a> (formerly W3C)</li>

<li><a href="WebUSB" title="WebUSB">WebUSB</a></li></ul>

</div></td></tr></tbody></table><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Topics</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Ajax_(programming)" title="Ajax (programming)">Ajax</a> and <a href="Remote_scripting" title="Remote scripting">Remote scripting</a> vs. <a href="Dynamic_HTML" title="Dynamic HTML">DHTML</a></li>

<li><a href="Browser_extension" title="Browser extension">Browser extension</a></li>

<li><a href="Cross-site_scripting" title="Cross-site scripting">Cross-site scripting</a> and <a href="Cross-origin_resource_sharing" title="Cross-origin resource sharing">CORS</a></li>

<li><a href="Hydration_(web_development)" title="Hydration (web development)">Hydration</a></li>

<li><a href="Mashup_(web_application_hybrid)" title="Mashup (web application hybrid)">Mashup</a></li>

<li><a href="Client-side_persistent_data" title="Client-side persistent data">Persistent data</a></li>

<li><a href="Dynamic_web_page#Client-side_scripting" title="Dynamic web page">Scripting</a></li></ul>

<ul><li><a href="Frontend_and_backend" title="Frontend and backend">Frontend and backend</a></li>

<li><a href="Microservices" title="Microservices">Microservices</a>

<li><a href="GraphQL" title="GraphQL">GraphQL</a></li></ul></li>

<li><a href="Push_technology" title="Push technology">Push technology</a></li>

<li><a href="Solution_stack" title="Solution stack">Solution stack</a></li>

<ul><li><a href="Static_web_page" title="Static web page">Static</a></li>

<li><a href="Dynamic_web_page" title="Dynamic web page">Dynamic</a></li></ul></li>

<li><a href="Web_standards" title="Web standards">Web standards</a></li>

<li><a href="Web_application" title="Web application">Web application</a>

<li><a href="Single-page_application" title="Single-page application">Single-page</a></li>

<li><a href="Progressive_web_app" title="Progressive web app">Progressive</a></li></ul></li>

<li><a href="Web_framework" title="Web framework">Web framework</a></li></ul>

</div></td></tr></tbody></table><div></div></td></tr></tbody></table></div>

<div class="navbox-styles"></div><div role="navigation" class="navbox" aria-labelledby="Information_security92" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="3"><div id="Information_security92" style="font-size:114%;margin:0 4em"><a href="Information_security" title="Information security">Information security</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Threat_(computer)" class="mw-redirect" title="Threat (computer)">Threats</a></th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Adware" title="Adware">Adware</a></li>

<li><a href="Advanced_persistent_threat" title="Advanced persistent threat">Advanced persistent threat</a></li>

<li><a href="Arbitrary_code_execution" title="Arbitrary code execution">Arbitrary code execution</a></li>

<li><a href="Backdoor_(computing)" title="Backdoor (computing)">Backdoors</a></li>

<li>Bombs

<li><a href="Logic_bomb" title="Logic bomb">Logic</a></li>

<li><a href="Hardware_backdoor" title="Hardware backdoor">Hardware backdoors</a></li>

<li><a href="Code_injection" title="Code injection">Code injection</a></li>

<li><a href="Crimeware" title="Crimeware">Crimeware</a></li>

<li><a href="Cross-site_scripting" title="Cross-site scripting">Cross-site scripting</a></li>

<li><a href="Cross-site_leaks" title="Cross-site leaks">Cross-site leaks</a></li>

<li><a href="DOM_clobbering" title="DOM clobbering">DOM clobbering</a></li>

<li><a href="History_sniffing" title="History sniffing">History sniffing</a></li>

<li><a href="Cryptojacking" title="Cryptojacking">Cryptojacking</a></li>

<li><a href="Botnet" title="Botnet">Botnets</a></li>

<li><a href="Data_breach" title="Data breach">Data breach</a></li>

<li><a href="Drive-by_download" title="Drive-by download">Drive-by download</a></li>

<li><a href="Browser_Helper_Object" title="Browser Helper Object">Browser Helper Objects</a></li>

<li><a href="Computer_virus" title="Computer virus">Viruses</a></li>

<li><a href="Data_scraping" title="Data scraping">Data scraping</a></li>

<li><a href="Denial-of-service_attack" title="Denial-of-service attack">Denial-of-service attack</a></li>

<li><a href="Eavesdropping" title="Eavesdropping">Eavesdropping</a></li>

<li><a href="Email_fraud" title="Email fraud">Email fraud</a></li>

<li><a href="Email_spoofing" title="Email spoofing">Email spoofing</a></li>

<li><a href="Exploit_(computer_security)" title="Exploit (computer security)">Exploits</a></li>

<li><a href="Dialer#Fraudulent_dialer" title="Dialer">Fraudulent dialers</a></li>

<li><a href="Hacktivism" title="Hacktivism">Hacktivism</a></li>

<li><a href="Infostealer" title="Infostealer">Infostealer</a></li>

<li><a href="Insecure_direct_object_reference" title="Insecure direct object reference">Insecure direct object reference</a></li>

<li><a href="Keystroke_logging" title="Keystroke logging">Keystroke loggers</a></li>

<li><a href="Malware" title="Malware">Malware</a></li>

<li><a href="Payload_(computing)" title="Payload (computing)">Payload</a></li>

<li><a href="Phishing" title="Phishing">Phishing</a>

<ul><li><a href="Voice_phishing" title="Voice phishing">Voice</a></li></ul></li>

<li><a href="Polymorphic_engine" title="Polymorphic engine">Polymorphic engine</a></li>

<li><a href="Privilege_escalation" title="Privilege escalation">Privilege escalation</a></li>

<li><a href="Ransomware" title="Ransomware">Ransomware</a></li>

<li><a href="Rootkit" title="Rootkit">Rootkits</a></li>

<li><a href="Scareware" title="Scareware">Scareware</a></li>

<li><a href="Shellcode" title="Shellcode">Shellcode</a></li>

<li><a href="Spamming" title="Spamming">Spamming</a></li>

<li><a href="Social_engineering_(security)" title="Social engineering (security)">Social engineering</a></li>

<li><a href="Spyware" title="Spyware">Spyware</a></li>

<li><a href="Software_bug" title="Software bug">Software bugs</a></li>

<li><a href="Trojan_horse_(computing)" title="Trojan horse (computing)">Trojan horses</a></li>

<li><a href="Hardware_Trojan" title="Hardware Trojan">Hardware Trojans</a></li>

<li><a href="Remote_access_trojan" class="mw-redirect" title="Remote access trojan">Remote access trojans</a></li>

<li><a href="Vulnerability_(computer_security)" title="Vulnerability (computer security)">Vulnerability</a></li>

<li><a href="Web_shell" title="Web shell">Web shells</a></li>

<li><a href="Wiper_(malware)" title="Wiper (malware)">Wiper</a></li>

<li><a href="Computer_worm" title="Computer worm">Worms</a></li>

<li><a href="SQL_injection" title="SQL injection">SQL injection</a></li>

<li><a href="Rogue_security_software" title="Rogue security software">Rogue security software</a></li>

<li><a href="Zombie_(computing)" title="Zombie (computing)">Zombie</a></li></ul>

</div></td><td class="noviewer navbox-image" rowspan="3" style="width:1px;padding:0 0 0 2px"><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Defenses</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Application_security" title="Application security">Application security</a>

<ul><li><a href="Secure_coding" title="Secure coding">Secure coding</a></li>

<li>Secure by default</li>

<li><a href="Secure_by_design" title="Secure by design">Secure by design</a>

<ul><li><a href="Misuse_case" title="Misuse case">Misuse case</a></li></ul></li></ul></li>

<li><a href="Computer_access_control" title="Computer access control">Computer access control</a>

<ul><li><a href="Authentication" title="Authentication">Authentication</a>

<ul><li><a href="Multi-factor_authentication" title="Multi-factor authentication">Multi-factor authentication</a></li></ul></li>

<li><a href="Authorization" title="Authorization">Authorization</a></li></ul></li>

<li><a href="Computer_security_software" title="Computer security software">Computer security software</a>

<ul><li><a href="Antivirus_software" title="Antivirus software">Antivirus software</a></li>

<li><a href="Security-focused_operating_system" title="Security-focused operating system">Security-focused operating system</a></li></ul></li>

<li><a href="Data-centric_security" title="Data-centric security">Data-centric security</a></li>

<li><a href="Obfuscation_(software)" title="Obfuscation (software)">Software obfuscation</a></li>

<li><a href="Data_masking" title="Data masking">Data masking</a></li>

<li><a href="Encryption" title="Encryption">Encryption</a></li>

<li><a href="Firewall_(computing)" title="Firewall (computing)">Firewall</a></li>

<li><a href="Intrusion_detection_system" title="Intrusion detection system">Intrusion detection system</a>

<ul><li><a href="Host-based_intrusion_detection_system" title="Host-based intrusion detection system">Host-based intrusion detection system</a> (HIDS)</li>

<li><a href="Anomaly_detection" title="Anomaly detection">Anomaly detection</a></li></ul></li>

<li><a href="Information_security_management" title="Information security management">Information security management</a>

<ul><li><a href="Information_risk_management" class="mw-redirect" title="Information risk management">Information risk management</a></li>

<li><a href="Security_information_and_event_management" title="Security information and event management">Security information and event management</a> (SIEM)</li></ul></li>

<li><a href="Runtime_application_self-protection" title="Runtime application self-protection">Runtime application self-protection</a></li>

<li><a href="Site_isolation" title="Site isolation">Site isolation</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Related<br>security<br>topics</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Computer_security" title="Computer security">Computer security</a></li>

<li><a href="Automotive_security" title="Automotive security">Automotive security</a></li>

<li><a href="Cybercrime" title="Cybercrime">Cybercrime</a>

<ul><li><a href="Cybersex_trafficking" title="Cybersex trafficking">Cybersex trafficking</a></li>

<li><a href="Computer_fraud" title="Computer fraud">Computer fraud</a></li></ul></li>

<li><a href="Cybergeddon" title="Cybergeddon">Cybergeddon</a></li>

<li><a href="Cyberterrorism" title="Cyberterrorism">Cyberterrorism</a></li>

<li><a href="Cyberwarfare" title="Cyberwarfare">Cyberwarfare</a></li>

<li><a href="Electronic_warfare" title="Electronic warfare">Electronic warfare</a></li>

<li><a href="Information_warfare" title="Information warfare">Information warfare</a></li>

<li><a href="Internet_security" title="Internet security">Internet security</a></li>

<li><a href="Mobile_security" title="Mobile security">Mobile security</a></li>

<li><a href="Network_security" title="Network security">Network security</a></li>

<li><a href="Copy_protection" title="Copy protection">Copy protection</a></li>

<li><a href="Digital_rights_management" title="Digital rights management">Digital rights management</a></li></ul>

</div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-01-30" href="https://en.wikipedia.org/wiki/?title=Web_API_security&oldid=1272802254">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>