aliyense pull request zomwe zimawonjezera kapena kusintha endpoint imasintha malo anu owukira a API. Zida zambiri zachitetezo za API sizizindikira mpaka endpoint itakhala yamoyo ndipo ikulandira kale magalimoto. Pofika nthawi imeneyo, kukonza sikulinso kusintha kwa mzere umodzi mu ndemanga ya code, ndikulankhulana koyankha zochitika.
Chitetezo cha API ndi njira yopezera ndikutseka zoopsa zomwe pulogalamu imavumbulutsa mapeto ake: ndani angawaimbire foni, deta yomwe abweza, komanso ngati akuchita zomwe zikalatazo zikunena kuti amachita.
Zipangizo zambiri zomwe zapangidwira vutoli zimayesa API panthawi yogwiritsira ntchito, kuchokera kunja, monga momwe wowukira angachitire. Njira imeneyo imagwira ntchito, koma imagwira ntchito kokha API ikangoyikidwa. Xygeni imatenga njira yoyambirira: imawerenga code yanu yoyambira ndi ma API anu musanapemphe ngakhale kamodzi kokha.
Njira Zinayi Zoyesera API, ndi Zomwe Yankho la Chilichonse
Mapulogalamu ambiri okhwima amayendetsa zoposa chimodzi mwa izi:
- Kuyesa kokhazikika Imasanthula ma code a gwero ndi ma API asanayikidwe. Imayankha kuti “tangovumbulutsa chiyani?” Iyi ndi njira yomwe nkhaniyi ikuyang'ana kwambiri.
- Kuyesa kwamphamvu (DAST) Imatumiza anthu enieni pa API yothamanga ndikuwona momwe imayankhira. Imayankha kuti "ndi chiyani chomwe chingapezeke komanso chomwe chingagwiritsidwe ntchito pakali pano?"
- Kusokoneza Imayika zinthu zosalongosoka kapena zosayembekezereka kumapeto kwa zinthu zomwe zawonongeka pamwamba pa chinthucho komanso kulephera kwa zinthu zina. Imayankha kuti “ndi zinthu ziti zomwe sitinayembekezere kuti zingachitike?”
- Kuyesa kulowa m'manja imawonjezera nzeru za anthu kuti apeze zolakwika zamaganizo zomwe zida zodzipangira zokha sizikugwira ntchito. Imayankha kuti "kodi wowukira wanzeru angagwirizanitse chiyani?"
Palibe chilichonse mwa izi chomwe chimalowa m'malo mwa zina. Zimayankha mafunso osiyanasiyana nthawi zosiyanasiyana pa moyo wa munthu, ndipo kusiyana komwe mapulogalamu ambiri amakhala nako ndi koyamba.
Chifukwa Chake Zida Zambiri Zachitetezo cha API Zimaona Kuopsa Mochedwa Kwambiri
Kuyesa chitetezo cha Runtime API kumatumiza anthu ambiri pa pulogalamu yamoyo ndikuwona momwe imayankhira. Ndi gawo lovomerezeka komanso lofunikira. Komanso, pomanga, ndi chizindikiro chotsalira: malo omalizira ayenera kukhalapo, kuyikidwa, ndikupezeka asanayambe kugwiritsa ntchito chida chofufuzira cha runtime. Chilichonse chomwe chapeza chinali chitawululidwa kale kwa nthawi yayitali ngakhale kuti chidatenga nthawi yayitali kuti chigwire ntchito.
Pali kusiyana kwachiwiri pansi pa vuto la nthawi. Zida za Runtime zimangoyesa zomwe zikudziwa kuti zilipo. Ngati malo omalizira sanalembedwepo, kapena OpenAPI spec yatha nthawi yomweyo munthu wina atatumiza njira yatsopano, chida chofufuzira runtime sichingadziwe kuti chilipo. Chimayesa mapu, osati dera.
Kuyesa chitetezo cha API yosasunthika kumatseka mipata yonse iwiri mwa kusuntha cheke kupita komwe kumapeto kwafotokozedwa: khodi yanu ndi zomwe API yanu imafotokoza, musanayigwiritse ntchito. pull request chomwe chimayambitsa mapeto ndi pull request zomwe zimabweretsa chiopsezo chake.
Kodi Chitetezo cha Static API Chimatanthauza Chiyani Kwenikweni?
Xygeni imamanga zinthu zanu za API kuchokera ku magwero awiri: source code ya pulogalamu yanu ndi ma API anu, kuphatikizapo OpenAPI ndi Swagger.
Mndandanda wazinthu zodziwika zokha umasonyeza ma endpoints omwe munthu anakumbukira kulemba. Mndandanda wazinthu zodziwika zokha umasonyeza zomwe zilipo koma osati momwe zinayenera kugwiritsidwira ntchito. Kuwerenga zonse ziwiri kumakupatsani chithunzi chonse: ma endpoints omwe magulu anu adalemba, ndi omwe palibe amene adachita.
Zinthu zimenezo ndi maziko omwe chilichonse chimamangidwira:
- Ma API onse omwe apezeka, ndi katundu yemwe ali pachiwopsezo amayesedwa poyerekeza ndi maziko
- Mapeto ogawidwa ndi njira ya HTTP
- Mavuto omwe agawidwa m'magulu malinga ndi utumiki
- Mapeto aliwonse ali ndi njira yake, njira yake, ntchito yake, gawo lake, momwe amavomerezera komanso chiwopsezo chake
Akatswiri anu a uinjiniya amawona mawonekedwe a malo anu a API popanda kutsegula tikiti iliyonse.
Mapeto onse a Xygeni adapeza, ndi njira yake, mkhalidwe wotsimikizira ndi chiwopsezo chake, zomangidwa kuchokera ku code ndi specification pamodzi.
Production note Dulani gulu la AI Triage kuchokera pachithunzi chilichonse cha API Security.
Yalumikizidwa ku OWASP API Security Top 10
Zomwe zapezeka zikuwonetsa momwe magulu anu achitetezo ndi owerengera anu amagwiritsira ntchito kale. Xygeni imazindikira zoopsa kudzera mu OWASP API Security Zapamwamba 10 (2023):
Gulu limodzi silikupezeka mwadala. API6, Unrestricted Access to Sensitive Business Flows, imafuna kumvetsetsa zomwe njira yabizinesi iyenera kulola, ndipo palibe static analyzer yomwe ingazindikire zimenezo modalirika. Wogulitsa aliyense amene akunena zosiyana akukugulitsani bokosi loyang'ana. Limenelo limakhalabe ndi chitsanzo chanu cha zoopsa ndi zoyesa zanu zolowera.
Si Zonse Zomwe Zapezeka Zili Zofanana: Kuzindikira Deta ndi Kuphatikiza Koopsa
Mndandanda wosasinthasintha wa zomwe zapezeka umaona kuti malo owunikira thanzi osatsimikizika ndi ofanana ndi malo owunikira thanzi osatsimikizika omwe amabweza mbiri ya makasitomala. Vutoli si lomweli, ndipo njira yowunikira zinthu zomwe zimayikidwa patsogolo imaphunzitsa magulu anu kunyalanyaza mndandandawo.
Xygeni imagawa deta yomwe gawo lililonse la endpoint limagwirira ntchito, kuyika chizindikiro pa PII, PCI ndi PHI mu magawo opempha ndi mayankho, ndipo imaphatikiza zomwezo ndi momwe endpoint imatsimikizirira.
Zimaphatikizanso zomwe zapezeka zomwe zimagwera pamalo omwewo ndipo zimawonjezera kuopsa kwake zikawonjezeka. Kutuluka kwa PII mu yankho ndi chinthu chachikulu chokha. Kutuluka komweko pamalo omwewo komwe sikufunikira kutsimikizika ndikofunikira kwambiri, ndipo nsanjayo imapeza mfundo mwanjira imeneyo m'malo mosiya kulumikizana kuti wina azindikire pamanja.
Mapeto a Zombie ndi Orphan: Kuyenda Pakati pa Code ndi Spec
Chifukwa Xygeni imawerenga code yanu ndi ma API anu pamodzi, imawona komwe sakugwirizana. Kusinthaku kumawonekera ngati njira zitatu zodziwika bwino:
- Mapeto osalembedwa. Amakhala ndi code ndipo sanawonjezedwepo ku spec.
- Mapeto a Zombie. Amalembedwa kuti sanagwiritsidwe ntchito kapena sanagwiritsidwe ntchito, ndipo akadali otheka kuwapeza.
- Mapeto a ana amasiye. Palibe aliyense mu timu yomwe ilipo pano amene ali ndi mphamvu zimenezi.
Palibe chilichonse mwa izi chomwe chimapezeka mu mndandanda wazinthu zapadera zokha, chifukwa zomwe zili mu mndandanda ndi zomwe zikusowa.
Umboni Womwe Mungachitepo Kanthu, Osati Tikiti Yofufuzira
Kupeza kulikonse kumasonyeza woyang'anira weniweni amene ali ndi udindo: fayilo, kalasi, njira, ndi mzere weniweni womwe unayambitsa cholakwikacho, ndi khodi yolakwika yomwe yaperekedwa pambali pake. Chilichonse chili ndi kuuma kwake, gulu lake la OWASP API Security Top 10, CWE yake, momwe endpoint imatsimikizidwira, komanso kugawa kwa chidziwitso cha deta yomwe ikukhudzidwa.
Kupeza komwe kumangotchula malo omalizira kumatumiza wopanga mapulogalamu kusaka kudzera mu codebase asanayambe kukonza chilichonse. Kupeza komwe kutchula mzerewo kumamuika pamalo oyenera nthawi yomweyo.
Zomwe zapezeka zimatumizidwa kunja monga JSON, CSV, Markdown ndi SARIF 2.1.0, kotero zimafika mu tmagulu anu omwe akugwira kale ntchito.
Woyang'anira, mzere, ndi khodi yomwe inayambitsa kuonekera kwa nkhaniyi. Si tikiti yofufuzira.
Chifukwa Chake Izi Zimakhala Papulatifomu Imodzi, Osati Console Yina
Xygeni imayendetsa API Security pamodzi ndi SAST, SCA, Chitetezo cha Zinsinsi, IaC ndi DAST mkati mwa nsanja imodzi, yolumikizidwa kudzera ASPM, m'malo motumiza ngati chida chosiyana ndi chake login ndi mbiri yake ya kumbuyo.
Izi ndizofunikira chifukwa zopeza zosasinthika ndi zopeza za nthawi yogwirira ntchito zimayankha mafunso osiyanasiyana okhudza endpoint yomweyi, ndipo zimakhala zothandiza kwambiri pamodzi kuposa kupatula. Static imakuuzani kuti endpoint ndi yoopsa isanatumizidwe. DAST imatsimikizira zomwe zingatheke komanso zomwe zingagwiritsidwe ntchito ikayamba kugwira ntchito.
Gawani izi pakati pa ma consoles awiri ndipo chiopsezo chogwirizanacho chimakhala ma backlog awiri osagwirizana. Palibe amene amawagwirizanitsa, ndipo mapeto omwe alibe zikalata komanso osatsimikizika sali pamzere uliwonse.
Onani malo anu enieni a API. Chitetezo cha API chikupezeka ngati pulogalamu yotetezera Enterprise Chowonjezera pa nsanja ya Xygeni, ndipo sikani imayenderana ndi malo anu osungiramo zinthu mkati mwa zomangamanga zanu.
FAQ
Kodi ingadziwe kuti ndi ma endpoint ati omwe amasamalira deta yachinsinsi?
Inde. Xygeni imayika PII, PCI ndi PHI mu magawo ndi mayankho a endpoint, ndipo imagwiritsa ntchito gulu limenelo kuti liyike zomwe zapezeka potengera momwe zinthu zilili.
Kodi ingathe kuyenda pa chilichonse pull request?
Inde. Kusanthula kowonjezereka kumafufuza ma endpoints okha omwe adasintha, ndipo manifest yomwe imapanga imatha kuyang'ana DAST scan yotsatira pama endpoints omwewo, kotero kuyesa kosasintha ndi kothamanga kumakhala kogwirizana ndi zomwe zidasunthadi.
Kodi code yanga imachoka pamalo anga?
Ayi. Ma scan amayendetsedwa ndi dongosolo lanu. Zotsatira zokha ndi zomwe zimakwezedwa, kutetezedwa paulendo komanso pamene zinthu zili pamalo opumulira.
Kodi ndingapeze bwanji chitetezo cha API?
Chitetezo cha API chikupezeka ngati pulogalamu yotetezera Enterprise chowonjezera. Pemphani PoC ndipo mudzafunsidwa.
