katoa pull request Ko te tāpiri, te whakarerekē rānei i tētahi pūwāhi ka whakarerekē i te mata o tō whakaeke API. Ko te nuinga o ngā taputapu haumarutanga API kāore e kite kia ora rā anō taua pūwāhi, ā, kua whiwhi kē i ngā tāngata. I taua wā, ehara te whakatikatika i te whakarerekētanga kotahi-rārangi i roto i te arotake waehere, engari he kōrero urupare aituā.
Ko te haumarutanga API te mahi o te kimi me te kati i ngā mōrearea e pā ana ki te whakaatu a tētahi tono i ōna pūmutunga: ko wai ka taea te waea atu ki a rātou, ko ēhea raraunga ka whakahokia mai, me te mea ka mahia e rātou ngā mea e kīia ana e te tuhinga.
Ko te nuinga o ngā taputapu i hangaia mō tēnei raruraru ka whakamātautau i te API i te wā e whakahaerehia ana, mai i waho, pērā i te huarahi e mahi ai te kaiwhakaeke. Ka mahi taua huarahi, engari ka mahi anake i muri i te whakatinanatanga o te API. Xygeni ka tangohia te ara o mua: ka pānuihia tō waehere pūtake me tō whakatakotoranga API i mua i te taenga o tētahi tono ki te pūwāhi.
Ngā Huarahi e Whā hei Whakamātautau i tētahi API, me ngā Whakautu o ia Huarahi
Ko te nuinga o ngā kaupapa pakeke e whakahaere ana i te neke atu i te kotahi o ēnei:
- Whakamātautau tūmau Ka tātarihia te waehere pūtake me ngā whakatakotoranga API i mua i te whakatinanatanga. Ka whakautua "he aha tā mātou i whakaatu noa iho nei?" Koinei te huarahi e arotahi ana tēnei tuhinga.
- Whakamātautau hihiri (DAST) Ka tukuna ngā waka tūturu ki tētahi API e rere ana, ā, ka mātakitaki i tana urupare. Ka whakautua "he aha te mea ka taea te toro atu me te whakamahi i tēnei wā?"
- Hurorirori kau Ka makahia he tāurunga hē, kāore rānei i te tūmanakohia ki ngā pito mutunga ki ngā tukinga mata me ngā rahunga taha-take. Ka whakautua "he aha ngā mea ka pakaru i raro i te tāurunga kāore i whakaarohia e tātou?"
- Whakamātautau werohanga ā-ringa tāpirihia te whakaaro tangata ki te kimi hapa arorau ka ngaro ngā taputapu aunoa. Ka whakautua "he aha te mea ka herea tahitia e te kaiwhakaeke atamai?"
Kāore tētahi o ēnei e whakakapi i ētahi atu. He rerekē ngā pātai e whakautua ana e rātou i ngā wā rerekē o te huringa ora, ā, ko te āputa kei te nuinga o ngā kaupapa ko te tuatahi.
He aha te nuinga o ngā taputapu haumarutanga API e kite ai i te mōrearea kua roa rawa
Ka tukuna e te whakamātautau haumarutanga API wā-oma ngā karere ki tētahi tono ora, ā, ka mātakitaki i tana urupare. He paparanga tika, he paparanga nui hoki. He tohu whakaroa anō hoki, nā te hanganga,: me noho he pito whakamutunga, me whakatinana, me taea te toro atu i mua i te taea e te matawai wā-oma te kōrero mōna. Ko ngā mea katoa e kitea ana e ia kua kitea kētia ahakoa te roa o te wā i whakahaerehia ai te matawai.
He āputa tuarua kei raro i taua raruraru wā. Ka taea e ngā taputapu wā-oma te whakamātautau i ngā mea e mōhiotia ana e rātou. Mena kāore i tuhia he pito whakamutunga, i tawhito rānei te whakatakotoranga OpenAPI i te wā i tukuna ai e tetahi he ara hou, kāore he huarahi a te matawai wā-oma ki te mōhio kei reira. Ka whakamātautauhia e ia te mahere, ehara i te rohe.
Mā te whakamātautau haumarutanga API tūmau ka kati ngā āputa e rua mā te neke i te tirotiro ki te wāhi kua tautuhia te pito whakamutunga: tō waehere me tō whakatakotoranga API, i mua i te whakatinanatanga. Pērā anō pull request e whakauru ana i tētahi pito ko te pull request e whakaatu ana i tōna mōrearea.
Te Tikanga Tuturu o te Haumarutanga API Pūmau
Ka hangaia e Xygeni tō rarangi API mai i ngā pūtake e rua: te waehere pūtake o tō taupānga me ngā whakatakotoranga o tō API, tae atu ki a OpenAPI me Swagger.
Ko te rarangi ingoa motuhake e whakaatu ana i ngā pūwāhi i maharatia e te tangata kia tuhia. Ko te rarangi ingoa waehere anake e whakaatu ana i ngā mea kei reira engari kāore i te whakaatu me pēhea te whakamahinga. Mā te pānui i ngā mea e rua ka hoatu ki a koe te pikitia katoa: ngā pūwāhi i tuhia e ō tīma, me ngā mea kāore i tuhia e te tangata.
Ko taua rarangi taonga te pūtake o ngā mea katoa:
- Ngā API katoa i kitea, me ngā rawa kei te mōrearea i inehia ki tētahi paerewa
- Ngā pūwāhi e wehea ana e te tikanga HTTP
- Ngā take i whakarōpūtia e te ratonga
- Ia pūwāhi me tōna tikanga, ara, ratonga, kōwae, āhua manatoko me te kaute mōrearea
Ka kite ō kaiārahi hangarau i te āhua o te mata o tō API me te kore e whakatuwhera i tētahi tīkiti kotahi.
Ko ia pūwāhi i kitea e Xygeni, me tana tikanga, te āhua motuhēhēnga me te kaute mōrearea, i hangaia mai i te waehere me ngā whakatakotoranga.
Production note Tapahia te papatohu AI Triage mai i tētahi whakaahua mata Haumarutanga API.
Kua maheretia ki te OWASP API Security Top 10
Mā ngā kitenga ka whakamāramahia te anga e whakamahia ana e ō rōpū haumarutanga me ō kaitātari. Ka kitea e Xygeni te mōrearea puta noa i te OWASP API Haumarutanga Runga 10 (2023):
Kotahi te kāwai kāore i te āta whakaarohia. Ko te API6, arā, ko te Urunga Kore Here ki ngā Rere Pakihi Tairongo, me mārama ki ngā mea e whakaaetia ana e te tukanga pakihi, ā, kāore he kaitātari tūmau e kitea ana i roto i te pono. Ko te kaihoko e kī ana i tētahi atu mea, kei te hoko atu i tētahi pouakataki ki a koe. Ka noho tonu tēnā ki tō whakatauira riri me ō kaiwhakamātautau urunga.
Kāore i te ōrite ngā kitenga katoa: Te aro nui ki ngā raraunga me ngā huinga paitini
He rite tonu te whakahaere a te rārangi papatahi o ngā kitenga i tētahi pito tirotiro hauora kāore i whakamanahia ki tētahi pito kāore i whakamanahia e whakahoki mai ana i ngā tuhinga a te kiritaki. Ehara i te mea kotahi te raruraru, ā, mā te tauira whakatau kaupapa matua e whiwhi ana i aua kaute ka whakangungu i ō tīma kia kaua e aro ki te rārangi.
Ka whakarōpūtia e Xygeni ngā raraunga e whakahaerehia ana e ia pito, ka tohua te PII, PCI me te PHI i roto i ngā tawhā tono me ngā whakautu, ā, ka honoa ēnei ki te āhua manatoko o te pito.
Ka honoa hoki ngā kitenga e tau ana ki te pito kotahi, ā, ka piki ake te kaha ina piki haere. He kitenga nui te turuturu PII i roto i tētahi urupare. He mea nui te turuturu kotahi i runga i tētahi pito kāore e hiahiatia he manatoko, ā, ka tohua e te tūāpapa pērā, kaua e waiho i te hononga kia kitea ā-ringa e tetahi.
Ngā Wāhi Whakamutunga o te Zombie me te Orphan: Te Rerenga i waenganui i te Waehere me te Spec
Nā te mea ka pānui tahi a Xygeni i tō waehere me tō whakatakotoranga API, ka kitea ngā wāhi e rerekē ana. Ka puta taua rerekētanga hei tauira e toru e mōhiotia ana:
- Ngā pūwāhi mutunga kāore i tuhia. Kei roto i te waehere ēnei, kāore i tāpirihia ki ngā whakaritenga.
- Ngā pito mutunga o ngā tūpāpaku. Kua tohua rātou kua kore e whakamahia, kua mutu rānei, ā, e taea tonu ana te whakapā atu ki a rātou.
- Ngā pito mutunga pani. Kāore tetahi o te tīma o nāianei e pupuri ana i a rātou.
Kāore tētahi o ēnei e puta mai ana i roto i tētahi rarangi taonga motuhake, nā te mea ko ngā āhuatanga motuhake tonu te mea kāore i roto i a rātou.
Ngā Taunakitanga Ka Taea e Koe te Mahi, Ehara i te Tikiti hei Tirotiro
Ko ia kitenga e tohu ana i te kaiwhakahaere tika e whai kawenga ana: te kōnae, te akomanga, te tikanga, me te raina motuhake i whakauru mai i te hapa, me te waehere hara i tukuna i te taha. Kei ia mea anō tōna kaha, tōna kāwai OWASP API Security Top 10, tōna CWE, te āhua manatoko o te pito mutunga, me te whakarōpūtanga tairongo o ngā raraunga e whai wāhi ana.
Mā te kitenga e whakaingoa noa ana i tētahi pito ka rapu te kaiwhakawhanake i roto i te pūtake waehere i mua i te tīmatanga o te whakatika i tētahi mea. Mā te kitenga e whakaingoa ana i te raina ka tere tonu tā rātou whakatika.
Ka kaweakehia ngā kitenga hei JSON, CSV, Markdown me SARIF 2.1.0, kia tau ai ki te tkei te mahi kē ā koutou tīma.
Ko te kaiwhakahaere, ko te rārangi, me te waehere i whakauru mai i te whakaaturanga. Ehara i te tīkiti hei tirotiro.
He aha tēnei e noho ana i te tūāpapa kotahi, ehara i te papatohu kē atu
Ka whakahaerehia e Xygeni te Haumarutanga API me SAST, SCA, Haumarutanga Ngā Mea Ngaro, IaC a DAST i roto i tētahi tūāpapa kotahi, e hono ana mā roto i ASPM, hei utu mō te tuku atu hei taputapu motuhake me tana ake login me āna ake mahi kei muri.
He mea nui tēnei nā te mea ka whakautua e ngā kitenga tūmau me ngā kitenga wā-oma ngā pātai rerekē mō te pūwāhi kotahi, ā, he pai ake te whai hua ngātahi i te wehe. Mā te tūmau e kī atu he mōrearea te pūwāhi i mua i te tukunga. Ka whakaū a DAST i te mea ka taea te toro atu me te whakamahi ina whakahaerehia.
Mā te wehewehe i tēnā ki ngā papatohu e rua, ka noho ko te mōrearea e hono ana ka noho hei rārangi mahi e rua kāore e pā ana. Kāore tetahi e whakataurite i a rāua, ā, ko te pūwāhi kāore i tuhia, kāore hoki i whakamanahia, ka noho ki roto i tētahi o ngā rārangi.
Tirohia te mata o tō whakaeke API tūturu. Kei te wātea te Haumarutanga API hei Enterprise tāpiri-ake ki te tūāpapa Xygeni, ā, ka rere he matawai ki ō ake putunga taonga i roto i tō ake hanganga.
FAQ
Ka taea e ia te kī ko ēhea ngā pito e whakahaere ana i ngā raraunga tairongo?
Āe. Ka tohua e Xygeni te PII, te PCI me te PHI i roto i ngā tawhā me ngā urupare mutunga, ā, ka whakamahia taua whakarōpūtanga hei whakatau i ngā kitenga mā te whakaaturanga tūturu.
Ka taea te rere i runga i ia pull request?
Āe. Ka tātarihia e te matawai tāpiripiri ngā pito whakamutunga anake i huri, ā, ka taea e te whakaaturanga e whakaputaina ana e ia te arotahi i tētahi matawai DAST e whai ake nei ki aua pito whakamutunga, kia noho rite tonu ai te whakamātautau tūmau me te whakamātautau wā-oma ki te mea i nekehia.
Ka puta atu taku waehere i taku taiao?
Kāo. Ka whakahaerehia ngā matawai i roto i tō ake hanganga. Ko ngā hua anake ka tukuatuhia, ka tiakina i te wā e tukuna ana, e waihotia ana rānei.
Me pēhea taku whiwhi i te Haumarutanga API?
Kei te wātea te Haumarutanga API hei Enterprise tāpiritanga. Tonoa he PoC, ā, ka tirotirohia tahitia me koe.
