wonke pull request eyongeza okanye etshintsha indawo yokugqibela itshintsha indawo yakho yokuhlasela ye-API. Uninzi lwezixhobo zokhuseleko ze-API aziqapheli de loo ndawo yokugqibela ivele kwaye sele ithatha ithrafikhi. Ngelo xesha, ukulungiswa akusekho lutshintsho lomgca omnye kuphononongo lwekhowudi, yingxoxo yempendulo yesiganeko.
Ukhuseleko lwe-API luqheliselo lokufumana nokuvala iingozi kwindlela usetyenziso oluveza ngayo isiphelo salo: ngubani onokulubiza, luphi ulwazi olubuyayo, kunye nokuba bayakwenza oko uxwebhu luthi bayakwenza.
Uninzi lwezixhobo ezakhelwe le ngxaki zivavanya i-API ngexesha lokusebenza, ukusuka ngaphandle, ngendlela efanayo naleyo umhlaseli ebeya kwenza ngayo. Loo ndlela iyasebenza, kodwa isebenza kuphela emva kokuba i-API isetyenzisiwe. I-Xygeni ithatha indlela yangaphambili: ifunda ikhowudi yakho yomthombo kunye nenkcazo ye-API yakho ngaphambi kokuba isicelo esinye sifike kwindawo yokugqibela.
Iindlela ezine zokuvavanya i-API, kunye noko impendulo nganye nganye ikuphendulayo
Uninzi lweenkqubo zabantu abadala zisebenzisa ngaphezulu kwenye yezi:
- Uvavanyo olungatshintshiyo Ihlalutya ikhowudi yomthombo kunye neenkcukacha ze-API ngaphambi kokuba isetyenziswe. Iphendula ngokuthi “sityhile ntoni nje?” Le yindlela eli nqaku eligxile kuyo.
- Uvavanyo olutshintshayo (i-DAST) ithumela ithrafikhi yokwenyani kwi-API esebenzayo kwaye ijonge indlela ephendula ngayo. Iphendula ithi "yintoni enokufikeleleka nenokuxhaphazwa ngoku?"
- Ukufunxa Iphosa igalelo elingalunganga okanye elingalindelekanga kwiindawo zokugqibela ukuya kwiingozi zomphezulu kunye nokusilela kwecala lomgca. Iphendula ithi “zeziphi iingozi phantsi kwegalelo esingazilindelanga?”
- Uvavanyo lokungena ngesandla yongeza ugwebo lomntu ukuze kufunyanwe iziphene zengqiqo izixhobo ezizenzekelayo zingayiboni. Iphendula ithi “umhlaseli okrelekrele angadibanisa ntoni?”
Akukho nanye kwezi ithatha indawo yeminye. Ziphendula imibuzo eyahlukeneyo ngamaxesha ahlukeneyo kumjikelo wobomi, kwaye umsantsa okhoyo kwiinkqubo ezininzi ngowokuqala.
Kutheni Uninzi Lwezixhobo Zokhuseleko Ze-API Zibona Umngcipheko Kade Kakhulu
Uvavanyo lokhuseleko lwe-Runtime API luthumela ithrafikhi kwisicelo esibukhoma kwaye lujonga indlela esabela ngayo. Lumaleko osemthethweni noyimfuneko. Kwakhona, ngokwakhiwo, luphawu oluhlala luhleli: indawo yokugqibela kufuneka ibekho, ibekwe, kwaye ifikeleleke ngaphambi kokuba iskena sexesha lokusebenza sithethe nantoni na ngayo. Nantoni na eyifumanayo sele iveziwe nangona kuthathe ixesha elide kangakanani na ukuskena ukusebenza.
Kukho isithuba sesibini phantsi kwaloo ngxaki yexesha. Izixhobo zexesha lokuqalisa zinokuvavanya kuphela oko zikwaziyo ukuba kukho. Ukuba isiphelo asizange sibhalwe phantsi, okanye i-OpenAPI spec iphelelwe lixesha kwangoko xa umntu ethumela indlela entsha, iskena sexesha lokuqalisa asinandlela yokwazi ukuba sikhona. Sivavanya imephu, hayi indawo.
Uvavanyo lokhuseleko lwe-Static API luvala zombini izikhewu ngokususa itshekhi apho isiphelo sichazwe khona: ikhowudi yakho kunye nenkcazo ye-API yakho, ngaphambi kokusetyenziswa. pull request ozisa isiphelo yi pull request oko kubeka umngcipheko walo.
Oko Kuthethwa Yiyo Ngokwenene Ukhuseleko lwe-API Eqinileyo
I-Xygeni yakha uluhlu lwakho lwe-API kwimithombo emibini: ikhowudi yomthombo yesicelo sakho kunye neenkcukacha ze-API yakho, kuquka i-OpenAPI kunye ne-Swagger.
Uluhlu lwezinto ezifunekayo kuphela lubonisa iindawo zokugqibela umntu akhumbula ukuzibhala phantsi. Uluhlu lwezinto ezibhalwe ngekhowudi kuphela lubonisa oko kukhoyo kodwa kungekhona indlela ebekufanele kusetyenziswe ngayo. Ukufunda zombini kukunika umfanekiso opheleleyo: iindawo zokugqibela ezibhalwe ngamaqela akho, kunye nezo kungekho mntu wazibhalayo.
Loo mpahla sisiseko yonke into eyakhelwa phezu kwaso:
- Ii-API zizonke ezifunyenweyo, kunye neeasethi ezisengozini zilinganiswa ngokuthelekisa nesiseko
- Ii-Endpoints zahlulwe ngendlela ye-HTTP
- Imiba eqokelelwe ngokwenkonzo
- Isiphelo ngasinye sinendlela yaso, indlela yaso, inkonzo, imodyuli, imeko yokuqinisekisa kunye namanqaku omngcipheko.
Iingcali zakho zobunjineli zibona imilo yomphezulu wakho we-API ngaphandle kokuvula ithikithi elinye.
Yonke i-endpoint Xygeni ifumene, ngendlela yayo, imeko yokuqinisekisa kunye namanqaku omngcipheko, eyakhiwe ngekhowudi kunye neenkcukacha kunye.
Production note Nciphisa iphaneli ye-AI Triage kuyo nayiphi na umfanekiso weskrini we-API Security.
Imephu ye-OWASP API Security Top 10
Iziphumo zithetha ngesakhelo esisetyenziswa ngamaqela akho okhuseleko kunye nabahloli bakho. I-Xygeni ibona umngcipheko kulo lonke uKhuseleko lwe-API ye-OWASP Ezili-10 Eziphambili (2023):
Elinye icandelo alikho ngabom. I-API6, Ukufikelela Okungathintelwanga kwiMigudu yeShishini Enobuzaza, ifuna ukuqonda ukuba inkqubo yeshishini ifanele ivumele ntoni, kwaye akukho sixhobo sokuhlaziya esibonakalayo esifumanisa oko ngokuthembekileyo. Nawuphi na umthengisi othi akunjalo ukuthengisela ibhokisi yokujonga. Loo nto ihlala nemodeli yakho yosongelo kunye nabavavanyi bakho bokungena.
Ayizizo Zonke Izinto Ezifunyenweyo Ezilinganayo: Ubuthathaka Bedatha kunye NeeNdibaniselwano Ezinobuthi
Uluhlu oluthe tyaba lwezinto ezifunyenweyo luphatha isiphelo sokuhlolwa kwempilo esingaqinisekiswanga njengesiphelo sokugqibela esingaqinisekiswanga esibuyisela iirekhodi zabathengi. Ezo aziyongxaki ifanayo, kwaye imodeli yokubeka phambili ebanika amanqaku afanayo iqeqesha amaqela akho ukuba angalunanzi olu luhlu.
I-Xygeni ihlela idatha nganye ephathwa yi-endpoint, iphawula i-PII, i-PCI kunye ne-PHI kwiiparameter zesicelo nakwiimpendulo, kwaye idibanisa loo nto nemeko yokuqinisekiswa kwe-endpoint.
Ikwadibanisa iziphumo ezifika kwindawo enye kwaye iphakamisa ubukhali xa zihlangana. Ukuvuza kwe-PII kwimpendulo kukufumana okunzulu ngokwako. Ukuvuza okufanayo kwindawo enye okungadingi kuqinisekiswa kubalulekile, kwaye iqonga likunika amanqaku ngaloo ndlela endaweni yokushiya unxibelelwano ukuze umntu alubone ngesandla.
Ii-Endpoints zeZombie kunye neeNkedama: Ukuhamba Phakathi kweKhowudi kunye neSpec
Ngenxa yokuba iXygeni ifunda ikhowudi yakho kunye nenkcazo ye-API yakho ecaleni, ibona apho zingavumelani khona. Loo ntshukumo ibonakala njengeepateni ezintathu eziqaphelekayo:
- Iindawo zokugqibela ezingabhalwanga phantsi. Baphila ngekhowudi kwaye abazange bongezwe kwi-spec.
- Iindawo zokugqibela zeZombie. Ziphawulwa njengezingasasebenziyo okanye eziphelelwe lixesha, kwaye zisenokufunyanwa.
- Iindawo zokugqibela zeenkedama. Akukho mntu kwiqela langoku onazo.
Akukho nanye kwezi ebonakala kwi-inventri ye-spec-only, kuba i-spec yiyo kanye into elahlekileyo.
Ubungqina Onokuthatha Inyathelo Ngabo, Hayi Itikiti Lokuphanda
Yonke into efunyenweyo ikhomba kumphathi onoxanduva: ifayile, udidi, indlela, kunye nomgca othile owazisa isiphene, kunye nekhowudi ephosakeleyo ebekwe ecaleni kwayo. Ngayinye ikwaphethe ubunzima bayo, udidi lwayo lwe-OWASP API Security Top 10, i-CWE yayo, imeko yokuqinisekiswa kwesiphelo, kunye nokuhlelwa kobuntununtunu kwedatha ebandakanyekayo.
Ukufunyanwa okuchaza nje isiphelo kuthumela umphuhlisi ukuba azingele ikhowudi ngaphambi kokuba aqale ukulungisa nantoni na. Ukufunyanwa okuchaza umgca kubabeka esicombululweni ngoko nangoko.
Iziphumo zithunyelwa ngaphandle njengeJSON, CSV, Markdown kunye neSARIF 2.1.0, ukuze zifike kwi-tamaqela akho sele esebenza kuwo.
Umphathi, umgca, kunye nekhowudi eyazisa ukuvezwa. Asiyonto yokuphanda.
Kutheni le nto iphila kwiqonga elinye, hayi kwenye ikhonsoli
I-Xygeni isebenzisa uKhuseleko lwe-API ecaleni SAST, SCA, Ukhuseleko Lweemfihlo, IaC kwaye DAST ngaphakathi kweqonga elinye, elidityaniswe ASPMendaweni yokuyithumela njengesixhobo esahlukileyo ngesayo login kunye nokusilela kwayo.
Oko kubalulekile kuba iziphumo ezizinzileyo kunye neziphumo zexesha lokusebenza ziphendula imibuzo eyahlukeneyo malunga nendawo enye, kwaye ziluncedo ngakumbi xa zidibene kunokuba zihlukane. I-Static ikuxelela ukuba indawo yokugqibela iyingozi ngaphambi kokuba ithunyelwe. I-DAST iqinisekisa into enokufikeleleka kwaye isebenziseke xa sele isebenza.
Yahlula loo nto phakathi kwee-consoles ezimbini kwaye umngcipheko odibeneyo uba zizinto ezimbini ezingadibaniyo. Akukho mntu uzilungelelanisayo, kwaye isiphelo esingabhalwanga phantsi kwaye esingaqinisekiswanga asihlali kwimigca emibini.
Jonga indawo yakho yokuhlasela ye-API yokwenyani. Ukhuseleko lwe-API luyafumaneka njenge Enterprise i-add-on kwiqonga le-Xygeni, kwaye iskena sisebenza ngokuchasene neendawo zakho zokugcina izinto ezikwisiseko sakho.
FAQ
Ngaba ingaxela ukuba zeziphi iindawo zokugcina idatha eyimfihlo?
Ewe. I-Xygeni ibonisa i-PII, i-PCI kunye ne-PHI kwiiparameters zesiphelo kunye neempendulo, kwaye isebenzisa olo hlulo ukulinganisa iziphumo ngokwe-exposure yokwenyani.
Ngaba ingasebenza kuzo zonke pull request?
Ewe. Ukuskena okunyuswayo kuhlalutya kuphela iindawo zokugqibela ezitshintshileyo, kwaye i-manifest eyivelisayo inokugxila kwi-DAST scan elandelayo kwezo ndawo zokugqibela, ngoko ke uvavanyo oluzinzileyo nolwexesha lokusebenza luhlala luhambelana noko kushukumileyo ngokwenene.
Ngaba ikhowudi yam iyayishiya indawo endihlala kuyo?
Hayi. Iiskeni zisebenza kwisiseko sakho. Ziyalayishwa kuphela iziphumo, zikhuselwe xa usendleleni kwaye uphumle.
Ndingalufumana njani uKhuseleko lwe-API?
Ukhuseleko lwe-API luyafumaneka njenge Enterprise i-add-on. Cela i-PoC kwaye iya kuthathwa nawe.
