Leveraging the positive security model

In the previous section, I made the following statement: the definition is the contract—anything not in the contract is invalid. This is the key benefit of the positive security model, which is paramount in the quest to produce secure APIs.

To understand the benefits of contract-based security, let us consider the alternative negative security model, or the so-called blocklist (or disallow list) approach. In this approach, a protection tool (such as a Web Application Firewall (WAF)) will have a list of malicious data and patterns, and block any requests containing such data.

To understand quite how fragile this approach is, let us look at a sample of the ruleset for ModSecurity (a popular WAF engine):

# Example Payloads Detected:
# -------------------------
# OR 1#
# DROP sampletable;--
# admin'--
# DROP/*comment*/sampletable
# DR/**/OP/*bypass blacklisting*/sampletable
# SELECT/*avoid-spaces*/password/**/FROM/**/Members
...