Как защитить API: Уязвимости и решения

Start the free introductory course "Information Security Specialist" from Yandex Practicum https://ya.cc/t/jYpFATHw8pN33y Take a free quiz on the topic for reinforcement - https://qomp.club/quiz/71?topicId=5 Article on XXE - https://habr.com/ru/companies/vds/art... 00:00 Article Topic, Source 00:36 Interesting Points for Information Security Development 01:34 What We'll Talk About 02:08 A Little About API 04:06 The Dangers of API Attacks 05:24 Types of API Attacks 07:11 API Architectures 08:47 REST / JSON Vulnerabilities 09:04 Duplicate JSON Keys 11:22 Unicode Collisions and String Normalization 13:02 Comments and Non-standard JSON 1:56 PM SOAP - Logical Authorization Errors 2:22 PM SOAPAction Spoofing 3:30 PM XXE 4:03 PM How to Secure an API 5:16 PM Nginx App Protect 8:13 PM Russian Security Solutions Support the channel one-time - https://yoomoney.ru/to/410012243709514 Support the channel by subscribing - https://boosty.to/listenit Telegram channel - https://t.me/listenit_channel Yandex Zen - https://zen.yandex.ru/listenit Website with tests for channel episodes - https://qomp.club For collaboration inquiries - https://t.me/ed_akimov Link to the article - https://habr.com/ru/companies/angaras... Introduction to the REST API in 7 minutes -    • Введение в REST API за 7 минут   The differences between REST and SOAP in 4 minutes -    • Различия REST и SOAP за 4 минуты   What are RPC and gRPC in 10 minutes -    • Что такое RPC и gRPC за 10 минут   Comparing REST, RPC, GraphQL, and SOAP. Which is better for integration? -    • Сравнение REST, RPC, GraphQL и SOAP. Что л...   What is HTTP and HTTPS in 9 minutes -    • Что такое HTTP и HTTPS за 9 минут   What is GraphQL in 15 minutes with examples -    • Что такое GraphQL за 15 минут с примерами   What is JWT and how to create it -    • Что такое JWT и как его создать   What is OAuth 2.0 and OpenID Connect in 15 minutes -    • Что такое OAuth 2.0 и OpenID Connect за 15...   ALL HTTP STATUS CODES with examples -    • ВСЕ КОДЫ СОСТОЯНИЯ HTTP с примерами   ALL HTTP METHODS in 14 minutes -    • ВСЕ МЕТОДЫ HTTP за 14 минут   Introduction to REST API in 7 minutes -    • Введение в REST API за 7 минут   What is CACHE in 16 minutes: Designing Effective Caching -    • Что такое КЭШ за 16 минут: Проектируем эфф...   What is CORS in 10 minutes -    • Что такое CORS за 10 минут   What is HTTP/3 in 8 minutes -    • Что такое HTTP/3 за 8 минут   What is TCP/IP: Explained in Simple Terms -    • Что такое TCP/IP: Объясняем на пальцах   What is IDEMPOTENT -    • Что такое ИДЕМПОТЕНТНОСТЬ, или история Вас...   What is Apache Kafka in 5 minutes -    • Что такое Apache Kafka за 5 минут   What is RabbitMQ and how it differs from Apache Kafka in 10 minutes -    • Что такое RabbitMQ и чем он отличается от ...   Differences between SOA and Microservice Architecture in 9 minutes -    • Различия SOA и микросервисной архитектуры ...   Difference between STATEFUL and STATELESS in 14 minutes -    • Разница STATEFUL и STATELESS за 14 минут   What is HATEOAS in 4 minutes -    • Что такое HATEOAS за 4 минуты   What is CRUD in 6 minutes -    • Что такое CRUD за 6 минут   What is middleware in 7 minutes -    • Что такое middleware за 7 минут, и как он ...   What is UML in 7 minutes -    • Что такое UML за 7 минут: Диаграмма классо...   What is SQL and relational databases -    • Что такое SQL и реляционные базы данных   What are SQL INDEXES in 10 minutes -    • Что такое SQL ИНДЕКСЫ за 10 минут: Объясне...   What is NoSQL in 6 minutes -    • Что такое NoSQL за 6 минут   What is ACID in 9 minutes -    • Что такое ACID за 9 минут   Compilation and Interpretation in 10 Minutes -    • Компиляция и интерпретация за 10 минут   What is TypeScript in 9 Minutes -    • Что такое TypeScript за 9 минут   What is UML in 7 Minutes -    • Что такое UML за 7 минут: Диаграмма классо...   What is Scrum in 8 Minutes -    • Что такое Scrum за 8 минут   Agile Overview -    • Обзор Agile. Это методология, метод или фи...   Backlog Prioritization in 4 Minutes -    • Приоритизация бэклога за 4 минуты - опыт к...   What is Kanban -    • Что такое Канбан-метод - максимально коротко   What is a Kanban Board -    • Канбан-доска - это не то, что вы думаете   Machine Learning for Dummies -    • Машинное обучение для чайников   What is Big Data in 6 minutes -    • Что такое Big Data за 6 минут   Advertisement, ANO DPO "Yandex Educational Technologies", INN 7704282033, erid: 2VtzquyhuBA