How to protect your API from unauthorized requests

APIs are the core of modern applications, connecting different systems. However, they are also susceptible to unauthorized access and malicious exploitation. Protecting APIs requires multiple security policies, including CORS authentication, strong authentication, and real-time monitoring. This article will describe several ways to ensure that only trusted clients can access your API.

1. Correctly configure CORS

Cross-domain resource sharing (CORS) is a key security mechanism that controls which sources can interact with your API. Correct configuration of CORS can effectively prevent unauthorized access.

ASP.NET Core example:

 <code class="language-csharp">builder.Services.AddCors(options => { options.AddPolicy("RestrictedOrigins", policy => { policy.WithOrigins("https://mywebsite.com", "https://trustedpartner.com") // 允许的来源.AllowAnyHeader() .AllowAnyMethod(); }); }); // 应用CORS策略app.UseCors("RestrictedOrigins");</code>

Important rules:

• Avoid AllowAnyOrigin : Allowing all sources will greatly increase API risk.
• Do not use IsOriginAllowed(_ => true) : This will completely bypass source verification.
• Restrict methods and headers : Limit AllowAnyMethod and AllowAnyHeader to the required range.

2. Implement identity verification and authorization

Authentication ensures that only authorized users or systems can access your API endpoints. JSON Web Token (JWT) is a commonly used method.

JWT implementation steps:

1. The client sends a JWT in the request header:

 <code>Authorization: Bearer <your-jwt-token></your-jwt-token></code>

2. Server-side verification token:

 <code class="language-csharp">app.UseAuthentication(); app.UseAuthorization();</code>

ASP.NET Core configuration example:

 <code class="language-csharp">builder.Services.AddAuthentication("Bearer") .AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidateAudience = true, ValidateLifetime = true, ValidateIssuerSigningKey = true, ValidIssuer = "https://mywebsite.com", ValidAudience = "https://mywebsite.com", IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("secret-key")) }; });</code>

3. Explicitly verify the Origin header

Even with CORS configured, you can manually verify Origin header in server-side middleware, adding an extra layer of security.

Example:

 <code class="language-csharp">app.Use(async (context, next) => { string origin = context.Request.Headers["Origin"].ToString(); string[] allowedOrigins = { "https://mywebsite.com", "https://trustedpartner.com" }; if (!string.IsNullOrEmpty(origin) && !allowedOrigins.Contains(origin)) { context.Response.StatusCode = StatusCodes.Status403Forbidden; await context.Response.WriteAsync("Origin not allowed."); return; } await next(); });</code>

4. Block suspicious IPs

Filter and block requests from known malicious IP addresses to reduce the attack surface.

Middleware example:

 <code class="language-csharp">app.Use(async (context, next) => { string clientIp = context.Connection.RemoteIpAddress?.ToString(); string[] blockedIPs = { "192.168.1.100", "10.0.0.50" }; if (blockedIPs.Contains(clientIp)) { context.Response.StatusCode = StatusCodes.Status403Forbidden; await context.Response.WriteAsync("Blocked IP."); return; } await next(); });</code>

5. Implement rate limiting

Limit the number of client requests to prevent abuse and brute-force attacks.

ASP.NET Core example:

Installation package:

 <code class="language-bash">dotnet add package AspNetCoreRateLimit</code>

Configuration rate limit:

 <code class="language-csharp">builder.Services.AddMemoryCache(); builder.Services.Configure<ipratelimitoptions>(options => { options.GeneralRules = new List<ratelimitrule> { new RateLimitRule { Endpoint = "*", Limit = 100, // 请求限制Period = "1m" // 每分钟} }; }); builder.Services.AddInMemoryRateLimiting(); app.UseIpRateLimiting();</ratelimitrule></ipratelimitoptions></code>

6. All connections use HTTPS

Force HTTPS to ensure secure communication between the client and the API.

Configure HTTPS in ASP.NET Core:

 <code class="language-csharp">webBuilder.UseKestrel() .UseHttps();</code>

Redirect HTTP traffic to HTTPS:

 <code class="language-csharp">app.UseHttpsRedirection();</code>

7. Monitor and record requests

Implement logging, detect exception patterns, such as a large number of requests from unknown sources.

Example:

 <code class="language-csharp">app.Use(async (context, next) => { string origin = context.Request.Headers["Origin"].ToString(); Console.WriteLine($"Request from origin: {origin}"); await next(); });</code>

Use tools such as Application Insights, Serilog or Elastic Stack for comprehensive monitoring.

8. Avoid detailed error responses

Do not expose sensitive information in the error message, this will help the attacker.

Example:

 <code class="language-csharp">app.UseExceptionHandler("/error"); // 将错误重定向到安全页面</code>

in conclusion

Protecting the API from unauthorized requests requires multiple layers of defense: correctly configure CORS, explicitly verify the source and headers, implement authentication and rate limiting, use HTTPS and monitor traffic. Following these best practices can significantly reduce the risk of unauthorized access, ensuring that only trusted clients can access your API.

The above is the detailed content of How to protect your API from unauthorized requests. For more information, please follow other related articles on the PHP Chinese website!