Security · Topic 5 of 7
REST API Security
Describe how REST APIs are secured: HTTPS, basic authentication, tokens, API keys, OAuth 2.0 scopes, rate limiting, input validation and common attacks.
- 5 min
- Use HTTPS so that credentials and data are encrypted.
- Basic authentication uses Base64, which is an encoding and not encryption.
- Tokens are issued after login, and they are sent with later calls.
What it is
REST API security is the set of controls that stop the wrong people or programs from using an API, and stop correct users from misusing it.
A REST API is a web service. Anyone who can reach it over the network can try to call it, so every call needs to be protected. Network devices and controllers now expose APIs that can change configuration, which makes this a high value target.
How it works
Security for an API covers the connection, the identity, the permissions and the content.
Protect the connection
Every API call should travel over HTTPS, which is HTTP inside TLS. TLS encrypts the traffic, and it lets the client check the server certificate so that it talks to the real server.
Without HTTPS, credentials and data can be read or changed on the way. Do not place secrets in the URL, because URLs are kept in logs and in browser history.
Authentication
Authentication proves who is calling. The common methods are:
| Method | How it works | Notes |
|---|---|---|
| Basic authentication | Username and password, encoded with Base64 in a header | Base64 is an encoding and not encryption, so HTTPS is required |
| API key | A long secret value sent in a header or a query | Simple, but a leaked key gives full access until it is revoked |
| Token | A credential issued after login and sent on later calls | Short lived, so less risk than a password sent every time |
| OAuth 2.0 | A framework that issues access tokens with limited scope | Used when one app acts for a user on another service |
A token flow is common on Cisco controllers. The client sends its credentials once, receives a token, and then sends the token with later requests. In Catalyst Center, a client asks the authentication endpoint for a token using basic authentication, and then sends it in a header named X-Auth-Token on later calls.
POST /dna/system/api/v1/auth/token HTTP/1.1
Host: catalyst.example
Authorization: Basic BASE64OFUSERNAMEANDPASSWORDA token can expire, and the client then asks for a new one. Short lifetimes limit the damage if a token is stolen.
Authorisation
Authorisation decides what an authenticated caller may do. Two ideas matter.
- Role based access control (RBAC): each user has a role, and each role has permissions, such as read only or administrator.
- Least privilege: give each account or app only the access that it needs.
OAuth 2.0 adds scopes, which limit what a token can do. An app given a read scope cannot change anything, even if it tries.
Other protections
| Control | Purpose |
|---|---|
| Input validation | Reject data that is not in the expected form, which blocks injection attacks |
| Rate limiting | Cap the calls per client, which limits abuse and denial of service |
| Logging and monitoring | Record who called what, so attacks and mistakes can be traced |
| Certificate validation | Check the server certificate, and do not turn off checks to make a script work |
| Secret storage | Keep keys and passwords in a vault or protected file, not in the code |
Response codes that signal security issues
| Code | Meaning |
|---|---|
| 401 | Unauthorised, so the credentials are missing or wrong |
| 403 | Forbidden, so the caller is known but not allowed |
| 429 | Too many requests, so the caller was rate limited |
The difference between 401 and 403 is a common exam point. A 401 is an authentication problem. A 403 is an authorisation problem.
Common attacks
- Credential theft: stolen passwords, keys or tokens used to call the API.
- Injection: hostile input sent to run commands or queries on the server.
- Man in the middle: an attacker reads or changes the traffic when HTTPS is not used or the certificate is not checked.
- Denial of service: a flood of calls that exhausts the service.
- Excess access: an API that returns or allows more than the caller should have.
Good practice for network automation
- Use HTTPS with valid certificates.
- Create service accounts for scripts, with the least privilege they need.
- Use short lived tokens where the platform supports them.
- Keep secrets out of scripts and out of version control.
- Log and review API activity.
What to remember for the exam
Eight facts cover most questions on this topic.
- Use HTTPS so that credentials and data are encrypted.
- Basic authentication uses Base64, which is an encoding and not encryption.
- Tokens are issued after login, and they are sent with later calls.
- OAuth 2.0 issues access tokens with scopes.
- RBAC and least privilege limit what a caller can do.
- Rate limiting and input validation reduce abuse and injection.
- A 401 response is an authentication failure, and a 403 response is an authorisation failure.
- Do not put secrets in a URL or in source code.
To separate 401 and 403, ask who the caller is. If the system does not know them, it is 401, and if it knows them but says no, it is 403.
Common mistakes
These four mistakes appear often.
Treating Base64 as encryption. Anyone can decode it, so it needs HTTPS around it.
Turning off certificate checks. It removes the protection against a fake server.
Using one powerful account for every script. A leak then gives full control.
Hard coding keys in scripts. The keys end up in version control and shared copies.
An API key in a URL can leak through logs, so send keys in a header over HTTPS.
Check yourself
Work through these three questions.
Why is basic authentication unsafe without HTTPS?
The credentials are only Base64 encoded, which is easy to decode, so HTTPS must protect them.
What does a 403 response mean?
The caller is known but is not allowed to do that action, which is an authorisation failure.
What does a scope do in OAuth 2.0?
It limits what an access token can be used for, such as read only access.
Topic 5 of 7 in Security
Test yourself on Security
The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.