REST API Review: Unexpected Security Lessons

While I was building the project, I wanted to review the REST API again and I found the good resources to study it. Instead of me explaining all about REST API, I would like to share this website.

https://www.freecodecamp.org/news/build-consume-and-document-a-rest-api/

What I honestly didn't know about in REST API is:

• Security concerns: REST APIs can be vulnerable to security attacks such as cross-site scripting (XSS) and cross-site request forgery (CSRF) if not implemented properly.

then why is it so?


Cross-Site Scripting (XSS)

• How it works:
  
  
• XSS occurs when malicious scripts are injected into web applications that other users view.
• In the context of REST APIs, if an API accepts user-supplied data (e.g., in a request body or query parameter) and doesn't properly sanitize it before returning it in a response, that data could contain malicious JavaScript.
• When a client-side application (like a web browser) receives the API response and renders it, the injected script executes, potentially stealing sensitive data (like cookies or session tokens) or performing unauthorized actions.
  
  
• Why REST APIs are vulnerable:
  
  
• REST APIs often return data in formats like JSON or XML, which can be easily parsed and manipulated by client-side JavaScript.
• If the API doesn't encode or sanitize user-supplied data before including it in the response, it becomes a vector for XSS attacks.
• Many APIs are designed to be used by web applications, therefore the data they provide will be rendered into a web page.
  
  
• Example:
  
  
• Imagine an API that returns user comments. If a user submits a comment containing <script>alert('XSS');</script>, and the API returns this comment without proper sanitization, any client-side application displaying the comment will execute the alert.

Cross-Site Request Forgery (CSRF)

• How it works:
  
  
• CSRF exploits the trust a website has in a user's browser.
• An attacker tricks a user into performing an unwanted action on a website where they're currently authenticated.
• This is done by embedding malicious code (e.g., in an image tag or a hidden form) on a website the attacker controls.
• When the user visits the attacker's website, the malicious code sends a request to the vulnerable website, leveraging the user's existing authentication.
  
  
• Why REST APIs are vulnerable:
  
  
• REST APIs often rely on browser-based authentication (like cookies).
• If an API endpoint performs state-changing operations (like creating, updating, or deleting data) and doesn't implement CSRF protection, an attacker can craft a request that triggers these operations.
• If the API relies solely on cookies for authentication, and does not check for other security tokens, then any request from the users browser will contain the authentication cookie, and therefor be valid.
  
  
  
• Example:
  
  
• Imagine a banking API with an endpoint /transfer?to=attacker&amount=1000. An attacker can embed an image tag like <img src="bank.com/transfer?to=attacker&amount=1000"> on their website. If a logged-in user visits the attacker's website, their browser will automatically send the request to the banking API, transferring money to the attacker.