description: API & Web services security (REST/GraphQL/SOAP), schema validation, authn/z, SSRF
languages:
- c
- go
- java
- javascript
- php
- python
- ruby
- typescript
- xml
- yaml
alwaysApply: false
rule_id: codeguard-0-api-web-services
API & Web Services Security
Secure REST, GraphQL, and SOAP/WS services end‑to‑end: transport, authn/z, schema validation, SSRF controls, DoS limits, and microservice‑safe patterns.
Transport and TLS
- HTTPS only; consider mTLS for high‑value/internal services. Validate certs (CN/SAN, revocation) and prevent mixed content.
Authentication and Tokens
- Use standard flows (OAuth2/OIDC) for clients; avoid custom schemes. For services, use mTLS or signed service tokens.
- JWTs: pin algorithms; validate iss/aud/exp/nbf; short lifetimes; rotation; denylist on logout/revoke. Prefer opaque tokens when revocation is required and central store is available.
- API keys: scope narrowly; rate limit; monitor usage; do not use alone for sensitive operations.
Authorization
- Enforce per‑endpoint, per‑resource checks server‑side; deny by default.
- For microservices, authorize at gateway (coarse) and service (fine) layers; propagate signed internal identity, not external tokens.
Input and Content Handling
- Validate inputs via contracts: OpenAPI/JSON Schema, GraphQL SDL, XSD. Reject unknown fields and oversize payloads; set limits.
- Content types: enforce explicit Content‑Type/Accept; reject unsupported combinations. Harden XML parsers against XXE/expansion.
SQL/Injection Safety in Resolvers and Handlers
- Use parameterized queries/ORM bind parameters; never concatenate user input into queries or commands.
GraphQL‑Specific Controls
- Limit query depth and overall complexity; enforce pagination; timeouts on execution; disable introspection and IDEs in production.
- Implement field/object‑level authorization to prevent IDOR/BOLA; validate batching and rate limit per object type.
SSRF Prevention for Outbound Calls
- Do not accept raw URLs. Validate domains/IPs using libraries; restrict to HTTP/HTTPS only (block file://, gopher://, ftp://, etc.).
- Case 1 (fixed partners): strict allow‑lists; disable redirects; network egress allow‑lists.
- Case 2 (arbitrary): block private/link‑local/localhost ranges; resolve and verify all IPs are public; require signed tokens from the target where feasible.
SOAP/WS and XML Safety
- Validate SOAP payloads with XSD; limit message sizes; enable XML signatures/encryption where required.
- Configure parsers against XXE, entity expansion, and recursive payloads; scan attachments.
Rate Limiting and DoS
- Apply per‑IP/user/client limits, circuit breakers, and timeouts. Use server‑side batching and caching to reduce load.
Management Endpoints
- Do not expose over the Internet. Require strong auth (MFA), network restrictions, and separate ports/hosts.
Testing and Assessment
- Maintain formal API definitions; drive contract tests and fuzzing from specs.
- Assess endpoints for authn/z bypass, SSRF, injection, and information leakage; log token validation failures.
Microservices Practices
- Policy‑as‑code with embedded decision points; sidecar or library PDPs.
- Service identity via mTLS or signed tokens; never reuse external tokens internally.
- Centralized structured logging with correlation IDs; sanitize sensitive data.
Implementation Checklist
- HTTPS/mTLS configured; certs managed; no mixed content.
- Contract validation at the edge and service; unknown fields rejected; size/time limits enforced.
- Strong authn/z per endpoint; GraphQL limits applied; introspection disabled in prod.
- SSRF protections at app and network layers; redirects disabled; allow‑lists where possible.
- Rate limiting, circuit breakers, and resilient patterns in place.
- Management endpoints isolated and strongly authenticated.
- Logs structured and privacy‑safe with correlation IDs.
Test Plan
- Contract tests for schema adherence; fuzzing with schema‑aware tools.
- Pen tests for SSRF, IDOR/BOLA, and authz bypass; performance tests for DoS limits.
- Test all HTTP methods per endpoint; discover parameters in URL paths, headers, and structured data beyond obvious query strings.
- Automated checks for token validation and revocation behavior.
1---2name: 207-control-set-09-api-security-c77f33633description: <!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->4---5<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->67---8description: API & Web services security (REST/GraphQL/SOAP), schema validation, authn/z, SSRF9languages:10- c11- go12- java13- javascript14- php15- python16- ruby17- typescript18- xml19- yaml20alwaysApply: false21---2223rule_id: codeguard-0-api-web-services2425## API & Web Services Security2627Secure REST, GraphQL, and SOAP/WS services end‑to‑end: transport, authn/z, schema validation, SSRF controls, DoS limits, and microservice‑safe patterns.2829### Transport and TLS30- HTTPS only; consider mTLS for high‑value/internal services. Validate certs (CN/SAN, revocation) and prevent mixed content.3132### Authentication and Tokens33- Use standard flows (OAuth2/OIDC) for clients; avoid custom schemes. For services, use mTLS or signed service tokens.34- JWTs: pin algorithms; validate iss/aud/exp/nbf; short lifetimes; rotation; denylist on logout/revoke. Prefer opaque tokens when revocation is required and central store is available.35- API keys: scope narrowly; rate limit; monitor usage; do not use alone for sensitive operations.3637### Authorization38- Enforce per‑endpoint, per‑resource checks server‑side; deny by default.39- For microservices, authorize at gateway (coarse) and service (fine) layers; propagate signed internal identity, not external tokens.4041### Input and Content Handling42- Validate inputs via contracts: OpenAPI/JSON Schema, GraphQL SDL, XSD. Reject unknown fields and oversize payloads; set limits.43- Content types: enforce explicit Content‑Type/Accept; reject unsupported combinations. Harden XML parsers against XXE/expansion.4445### SQL/Injection Safety in Resolvers and Handlers46- Use parameterized queries/ORM bind parameters; never concatenate user input into queries or commands.4748### GraphQL‑Specific Controls49- Limit query depth and overall complexity; enforce pagination; timeouts on execution; disable introspection and IDEs in production.50- Implement field/object‑level authorization to prevent IDOR/BOLA; validate batching and rate limit per object type.5152### SSRF Prevention for Outbound Calls53- Do not accept raw URLs. Validate domains/IPs using libraries; restrict to HTTP/HTTPS only (block file://, gopher://, ftp://, etc.).54- Case 1 (fixed partners): strict allow‑lists; disable redirects; network egress allow‑lists.55- Case 2 (arbitrary): block private/link‑local/localhost ranges; resolve and verify all IPs are public; require signed tokens from the target where feasible.5657### SOAP/WS and XML Safety58- Validate SOAP payloads with XSD; limit message sizes; enable XML signatures/encryption where required.59- Configure parsers against XXE, entity expansion, and recursive payloads; scan attachments.6061### Rate Limiting and DoS62- Apply per‑IP/user/client limits, circuit breakers, and timeouts. Use server‑side batching and caching to reduce load.6364### Management Endpoints65- Do not expose over the Internet. Require strong auth (MFA), network restrictions, and separate ports/hosts.6667### Testing and Assessment68- Maintain formal API definitions; drive contract tests and fuzzing from specs.69- Assess endpoints for authn/z bypass, SSRF, injection, and information leakage; log token validation failures.7071### Microservices Practices72- Policy‑as‑code with embedded decision points; sidecar or library PDPs.73- Service identity via mTLS or signed tokens; never reuse external tokens internally.74- Centralized structured logging with correlation IDs; sanitize sensitive data.7576### Implementation Checklist77- HTTPS/mTLS configured; certs managed; no mixed content.78- Contract validation at the edge and service; unknown fields rejected; size/time limits enforced.79- Strong authn/z per endpoint; GraphQL limits applied; introspection disabled in prod.80- SSRF protections at app and network layers; redirects disabled; allow‑lists where possible.81- Rate limiting, circuit breakers, and resilient patterns in place.82- Management endpoints isolated and strongly authenticated.83- Logs structured and privacy‑safe with correlation IDs.8485### Test Plan86- Contract tests for schema adherence; fuzzing with schema‑aware tools.87- Pen tests for SSRF, IDOR/BOLA, and authz bypass; performance tests for DoS limits.88- Test all HTTP methods per endpoint; discover parameters in URL paths, headers, and structured data beyond obvious query strings.89- Automated checks for token validation and revocation behavior.
tools-only