Shift-Left for API Security

Now that we have a deeper understanding of the methods and techniques used by API attackers, it is time to turn our focus to the core topic of defending APIs against attack.

In this opening chapter of Part 3 – Defending APIs, the focus will be on how API security can be improved by following a shift-left approach. The best way to avoid vulnerabilities in your APIs is to avoid introducing them in the first place. Although this sounds easier said than done, there is growing evidence from the software-development industry that addressing security concerns as early as possible in the lifecycle results in reduced risk and costs.

APIs are very well suited to a shift-left approach, since the appeal of a design-first approach (using the OpenAPI definition as the source of truth for the API) is fast becoming the de facto technique for API development. This chapter discusses various approaches to incorporating security during the design stage and then...