Explore the fundamentals of REST APIs and their security implications in this 28-minute conference talk from Derbycon 2016. Dive into key concepts such as REST vs SOAP, status codes, data formats, and resource relationships. Learn about RESTful API classification and testing techniques using tools like Postman and Burp Suite. Discover essential security considerations, including protecting HTTP methods, implementing JSON Web Tokens (JWT), safeguarding sensitive resources, and applying input validation and output encoding. Gain valuable insights to enhance your understanding of REST API development and security practices.
Overview
Syllabus
Introduction
Overview
Background
REST vs SOAP
Status Codes
Data Format
Resource Relationships
RESTful API Classification
Testing RESTful APIs
Postman
Burp Suite
Security Concerns
Sample API
Protect HTTP Methods
JSON Web Tokens (JWT)
Protect Sensitive Resources
Input Validation
Output Encoding
QUESTIONS??
