Course Description
Security should never be an afterthought, especially when dealing with network resources; and REST APIs are no exception. It involves more than just protecting information: it's a comprehensive approach that also involves managing clients and protecting the stability of an API service.
The use of API keys and secrets is a very common pattern that grants user/password-type authentication capabilities to registered clients. In these lessons, you will learn how API keys and secrets are generated and sent to RESTful API services to gain access, as well as the accompanying 400-series HTTP status codes that result when keys and secrets are not recognized.
The OAuth protocol has become the standard mechanism for API client authorization, and you will learn the basics of OAuth and how basic authentication requests can result in bearer access tokens that can be applied to many levels of scopes. You will also learn the importance of rate limiting and why it is essential for REST APIs to track and restrict inbound traffic. Rate limiting is necessary to remain within capacity limits and also to deflect DDoS attacks, which seek to disable services by sending massive amounts of traffic.
What You'll Learn
- Identify the common security mechanisms used to protect REST APIs
- Generate and use API keys and secrets to access protected APIs
- Issue OAuth authorization requests for scoped access to APIs
- Apply bearer access tokens obtained from basic authentication requests
- Interpret the 400-series HTTP status codes returned when keys and secrets are not recognized
- Implement rate limiting to track and restrict inbound API traffic
Key Takeaways
- API security is a comprehensive approach that involves protecting information, managing clients, and protecting the stability of an API service.
- API keys and secrets grant user/password-type authentication capabilities to registered clients accessing RESTful API services.
- OAuth has become the standard mechanism for API client authorization, where basic authentication requests can result in bearer access tokens applied to many levels of scopes.
- Rate limiting is essential for REST APIs to remain within capacity limits and to deflect DDoS attacks that send massive amounts of traffic to disable services.
- Unrecognized keys and secrets result in 400-series HTTP status codes.
Frequently Asked Questions
What does this course cover?
It covers security for REST APIs, including how API keys and secrets are generated and sent to gain access, the basics of OAuth authorization and bearer access tokens, and the importance of rate limiting to control traffic and deflect DDoS attacks.
What will I be able to do after taking this course?
You will be able to identify the common security mechanisms used for REST APIs, use keys and secrets to access protected APIs, and issue OAuth authorization requests for scoped access to APIs.
What lessons are included?
The course includes three lessons: API Keys and Access Management; Using OAuth for Authentication; and Using Rate Limiting to Control Traffic.
What skills does this course help develop?
It develops skills in API Design, API Management, API Testing, Application Programming Interface (API), REST API Development, and RESTful API.
Why is rate limiting important for REST APIs?
Rate limiting is necessary to remain within capacity limits and to deflect DDoS attacks, which seek to disable services by sending massive amounts of traffic.
