– Ideally all traffic passing inward and outward should be encrypted and preferably via TLS.– Ideally, there should be no API endpoints that are not strongly secured, if so, these will be captured by the inventory-audit.Use Strong Authentication And Authorization On All API Endpoints.– As with the applications themselves, any security concerns should be in the very early planning stages of any new apps or features using API endpoints.Build API Security For New Applications/Features At The Planning Stage.Scan code for CFHTTP calls and CFCs that expose API.This audit should show the actual requirement of each API endpoint and any vulnerabilities shown in the table above. – This should be a first step in determining what the attack surface could be.Man-in-the-Middle Attacks: Ensure that all transmitted data is fully encrypted.In addition ensure that data delivered via the API does not expose any possible vulnerabilities.

Injection Attacks akin to SQL Injection: Check, sanitize and validate all the data inputs passed via API requests.Distributed Denial of Service Attacks DdoS: Impose limits on the amount and frequency of data inputs and outputs.In this case, validate all input using character escaping and filtering. Here malicious actors try to insert subversive scripts (often JavaScript) which can be executed. Cross-Site-Scripting XSS: As we can see, many of these attacks already exist in the website world.Pay close attention to the origin, rate and frequency of authorization requests. Credential Stuffing: Malicious actors using stolen credentials to gain unauthorized access to API endpoints.A portal into the middle of your code functionality and data.Other company’s data eg USP shipping tracking.API use is increasing exponentially, which can expose serious security issues.“APIs are extremely popular these days, with an average organization leveraging 15,564 APIs in total, up 201% year-on-year.” From this article in TechRadar, from April 2022.

Remote API calls: False assumption that APIs your app calls are secure – but they may not be.

Adobe coldfusion 11 download