Njalo pull request lokho kunezela noma kushintsha indawo yokugcina kushintsha indawo yakho yokuhlasela ye-API. Amathuluzi amaningi okuphepha e-API awaqapheli kuze kube yilapho leyo ndawo yokugcina isibukhoma futhi isivele ithatha ithrafikhi. Ngaleso sikhathi, ukulungiswa akuseyona inguquko yomugqa owodwa ekubuyekezweni kwekhodi, kuyingxoxo yokuphendula isigameko.
Ukuphepha kwe-API kuwumkhuba wokuthola nokuvala izingozi endleleni uhlelo lokusebenza oluveza ngayo amaphuzu alo okugcina: ukuthi ubani ongazishayela ucingo, ukuthi yiluphi ulwazi olubuyayo, nokuthi ziyakwenza yini lokho okushiwo yidokhumenti.
Iningi lamathuluzi akhelwe le nkinga ahlola i-API ngesikhathi sokusebenza, kusukela ngaphandle, ngendlela efanayo nomhlaseli angenza ngayo. Leyo ndlela iyasebenza, kodwa isebenza kuphela ngemva kokuba i-API isetshenzisiwe. I-Xygeni ithatha indlela yokuqala: ifunda ikhodi yakho yomthombo kanye nencazelo yakho ye-API ngaphambi kokuba isicelo esisodwa sifike ekugcineni.
Izindlela Ezine Zokuhlola I-API, Nokuthi Ngayinye Iphendula Kanjani
Izinhlelo eziningi ezivuthiwe ziqhuba okungaphezu kweyodwa yalezi:
- Ukuhlola okumile Ihlaziya ikhodi yomthombo kanye nezincazelo ze-API ngaphambi kokusetshenziswa. Iphendula ngokuthi “yini esisanda kuyidalula?” Lena yindlela lesi sihloko esigxile kuyo.
- Ukuhlolwa kwe-Dynamic (DAST) ithumela ithrafikhi yangempela ku-API esebenzayo futhi ibheke ukuthi isabela kanjani. Iphendula ngokuthi “yini ngempela efinyelelekayo nesebenzisekayo njengamanje?”
- I-Fuzzing iphonsa okokufaka okungahambi kahle noma okungalindelekile ezindaweni zokugcina kuya ekushayweni kwendawo kanye nokwehluleka kwe-edge-case. Iphendula ngokuthi “yimaphi amaphutha ngaphansi kokufakwayo esingawalindelanga?”
- Ukuhlolwa kokungena ngesandla Ingeza ukwahlulela komuntu ukuthola amaphutha okucabanga amathuluzi azenzakalelayo awakwazi. Iphendula ngokuthi “yini engenziwa umhlaseli ohlakaniphile?”
Akukho neyodwa yalezi ethatha indawo yeminye. Ziphendula imibuzo ehlukene emazingeni ahlukene omjikelezo wokuphila, futhi igebe elikhona ezinhlelweni eziningi yilelo lokuqala.
Kungani Amathuluzi Okuphepha E-API Eningi Ebona Ingozi Sekwephuzile
Ukuhlolwa kokuphepha kwe-Runtime API kuthumela ithrafikhi kuhlelo lokusebenza olubukhoma futhi kubuke ukuthi luphendula kanjani. Kuyingqimba esemthethweni nedingekayo. Futhi, ngokwakhiwa, kuyinkomba ebambekayo: indawo yokugcina kufanele ibe khona, isetshenziswe, futhi ifinyeleleke ngaphambi kokuba iskena sesikhathi sokusebenza sisho noma yini ngakho. Noma yini eyitholayo yayisivele iveziwe noma ngabe kwathatha isikhathi eside kangakanani ukuskena ukusebenza.
Kukhona igebe lesibili ngaphansi kwaleyo nkinga yesikhathi. Amathuluzi e-Runtime angahlola kuphela lokho akwaziyo ukuthi kukhona. Uma i-endpoint ingakaze ibhalwe phansi, noma i-OpenAPI spec iphelelwe yisikhathi ngesikhathi othile ethumela umzila omusha, iskena se-runtime asinandlela yokwazi ukuthi sikhona. Sihlola imephu, hhayi indawo.
Ukuhlolwa kokuphepha kwe-Static API kuvala izikhala zombili ngokuhambisa isheke lapho kuchazwe khona iphuzu lokugcina: ikhodi yakho kanye nencazelo ye-API yakho, ngaphambi kokusetshenziswa. Okufanayo pull request okwethula iphuzu lokugcina yi- pull request lokho kuveza ingozi yakho.
Okushiwo Yi-Static API Security Empeleni
I-Xygeni yakha uhlu lwakho lwe-API oluvela emithonjeni emibili: ikhodi yomthombo yohlelo lwakho lokusebenza kanye nemininingwane ye-API yakho, okuhlanganisa i-OpenAPI kanye ne-Swagger.
Isitokwe se-spec-kuphela sibonisa amaphuzu okugcina umuntu akhumbule ukuwabhala phansi. Isitokwe sekhodi kuphela sibonisa okukhona kodwa hhayi ukuthi kwakuhloswe kanjani ukuthi sisetshenziswe. Ukufunda kokubili kukunikeza isithombe esiphelele: amaphuzu okugcina amaqembu akho awabhalile, kanye nalawo angazange abhalwe muntu.
Leso sitoko siyisisekelo konke okunye okwakhelwa phezu kwaso:
- Ama-API aphelele atholakele, kanye nezimpahla ezisengozini zilinganiswa ngokuqhathanisa nesisekelo
- Ama-Endpoints ahlukaniswe ngendlela ye-HTTP
- Izinkinga ziqoqwe ngesevisi
- Iphuzu ngalinye elinohlelo lwalo, indlela yalo, isevisi, imodyuli, isimo sokuqinisekisa kanye nesilinganiso sengozi
Abaholi bakho bobunjiniyela babona ukuma kwendawo yakho ye-API ngaphandle kokuvula ithikithi elilodwa.
I-Xygeni ngayinye endpoint ithole, ngendlela yayo, isimo sokuqinisekisa kanye nesilinganiso sengozi, yakhiwe ngekhodi kanye nokucaciswa ndawonye.
Production note Nciphisa iphaneli ye-AI Triage kunoma yisiphi isithombe-skrini se-API Security.
Kuqondiswe ku-OWASP API Security Top 10
Okutholakele kukhuluma ngohlaka olusetshenziswa kakade amaqembu akho okuphepha kanye nabahloli bakho bezimali. I-Xygeni ibona ubungozi kuyo yonke i-OWASP API Security Eziphezulu ezi-10 (2023):
Isigaba esisodwa asikho ngamabomu. I-API6, Ukufinyelela Okungavinjelwe Ku-Sensitive Business Flows, idinga ukuqonda ukuthi inqubo yebhizinisi kufanele ivumele ini, futhi akukho mshini wokuhlaziya oqondile obona lokho ngendlela ethembekile. Noma yimuphi umthengisi othi akunjalo ukuthengisela ibhokisi lokuhlola. Lowo uhlala nemodeli yakho yosongo kanye nabahloli bakho bokungena.
Akukhona Konke Okutholakele Okulinganayo: Ukuzwela Kwedatha kanye Nezinhlanganisela Ezinobuthi
Uhlu oluqondile lwezinto ezitholakele luphatha indawo yokugcina yokuhlola impilo engaqinisekisiwe njengendawo yokugcina engaqinisekisiwe ebuyisa amarekhodi amakhasimende. Lokho akuyona inkinga efanayo, futhi imodeli yokubeka phambili ebanikeza amaphuzu afanayo iqeqesha amaqembu akho ukuthi angalunaki uhlu.
I-Xygeni ihlukanisa idatha ngayinye ephathwa yi-endpoint, imaka i-PII, i-PCI kanye ne-PHI kumapharamitha esicelo kanye nasezimpendulweni, futhi ihlanganisa lokho nesimo sokuqinisekisa se-endpoint.
Iphinde ihlobanise okutholakele okufika endaweni efanayo yokugcina futhi kuphakamisa ubunzima lapho kuhlangana. Ukuvuza kwe-PII empendulweni kuyisinqumo esibucayi sodwa. Ukuvuza okufanayo endaweni yokugcina okungadingi ukuqinisekiswa kubalulekile, futhi ipulatifomu ikunikeza amaphuzu ngaleyo ndlela esikhundleni sokushiya uxhumano ukuze othile alubone ngesandla.
Ama-Endpoints e-Zombie kanye ne-Orphan: Ukuhamba Phakathi Kwekhodi kanye Nemininingwane
Ngenxa yokuthi i-Xygeni ifunda ikhodi yakho kanye nencazelo yakho ye-API eceleni, ibona lapho ingavumelani khona. Lokho kuzulazula kuvela njengamaphethini amathathu abonakalayo:
- Ama-endpoints angabhalisiwe. Baphila ngekhodi futhi abakaze bangezwe ku-spec.
- Ama-endpoints e-Zombie. Ziphawulwa njengezingasasebenzi noma eziphelelwe yisikhathi, futhi zisafinyeleleka.
- Iziphetho zezintandane. Akekho eqenjini lamanje onazo.
Akukho nokukodwa kwalokhu okubonakala ku-inventory ye-spec-only, ngoba i-spec yikona kanye okulahlekile.
Ubufakazi Ongabuthatha Isinyathelo, Hhayi Ithikithi Lokuphenya
Konke okutholakele kukhomba kumphathi oqondile onesibopho: ifayela, ikilasi, indlela, kanye nomugqa othize owenze iphutha, kanye nekhodi ephula umthetho ebekwe eceleni kwalo. Ngayinye futhi ithwala ubunzima bayo, isigaba sayo se-OWASP API Security Top 10, i-CWE yayo, isimo sokuqinisekisa se-endpoint, kanye nokuhlukaniswa kokuzwela kwedatha ehilelekile.
Ukuthola okumane kuqambe iphuzu lokugcina kuthumela unjiniyela ukuthi afune ngokusebenzisa i-codebase ngaphambi kokuthi aqale ukulungisa noma yini. Ukuthola okuqamba umugqa kubabeka esimeni sokulungisa ngokushesha.
Okutholakele kuthunyelwe njenge-JSON, CSV, Markdown kanye ne-SARIF 2.1.0, ukuze kufinyelele ku-tamaqembu akho asevele esebenza kuwo.
Umphathi, umugqa, kanye nekhodi eyethule lokhu kuvezwa. Akuyona ithikithi lokuphenya.
Kungani Lokhu Kuhlala Kupulatifomu Eyodwa, Hhayi Kwenye Ikhonsoli
I-Xygeni isebenzisa i-API Security eceleni SAST, SCA, Ukuphepha Kwezimfihlo, IaC futhi DAST ngaphakathi kwepulatifomu eyodwa, ehlobene ngokusebenzisa ASPM, esikhundleni sokuyithumela njengethuluzi elihlukile neyayo login kanye nokusilela kwayo.
Lokho kubalulekile ngoba okutholakele okungaguquki kanye nokutholakele kwesikhathi sokusebenza kuphendula imibuzo ehlukene mayelana nendawo yokugcina efanayo, futhi kuwusizo kakhulu ndawonye kunokuhlukana. I-Static ikutshela ukuthi indawo yokugcina iyingozi ngaphambi kokuba ithunyelwe. I-DAST iqinisekisa ukuthi yini efinyelelekayo futhi engasetshenziswa uma isisebenza.
Hlukanisa lokho phakathi kwama-console amabili bese kuba nengozi ehlobene kuba yizinsalela ezimbili ezingahlobene. Akekho ozivumelanisa, futhi indawo yokugcina engenalo irekhodi futhi engaqinisekisiwe ayihlali emgqeni.
Bona indawo yakho yangempela yokuhlasela ye-API. Ukuphepha kwe-API kuyatholakala njenge- Enterprise i-add-on epulatifomu ye-Xygeni, bese iskena sisebenza ngokumelene nezindawo zakho zokugcina izinto ngaphakathi kwengqalasizinda yakho.
Imibuzo Evame Ukubuzwa
Ingabe ingasho ukuthi yiziphi izindawo zokugcina ezisingatha idatha ebucayi?
Yebo. I-Xygeni imaka i-PII, i-PCI kanye ne-PHI kumapharamitha nezimpendulo ze-endpoint, futhi isebenzisa lokho kuhlukaniswa ukuze ibeke okutholakele ezingeni ngokuchayeka kwangempela.
Ingabe ingasebenza kuzo zonke pull request?
Yebo. Ukuskena okwandayo kuhlaziya kuphela ama-endpoints ashintshile, futhi i-manifest eyikhiqizayo ingagxila ukuskena okulandelayo kwe-DAST kulawo ma-endpoints afanayo, ngakho-ke ukuhlolwa kwe-static kanye nesikhathi sokusebenza kuhlala kuhambisana nalokho okuhambile ngempela.
Ingabe ikhodi yami iyashiya indawo yami?
Cha. Amaskeni asebenza engqalasizinda yakho. Imiphumela kuphela elayishwayo, evikelwe ngesikhathi sokuthutha kanye nalapho uphumule.
Ngikuthola kanjani ukuphepha kwe-API?
Ukuphepha kwe-API kuyatholakala njenge- Enterprise okungeziwe. Cela i-PoC futhi izotholakala nawe.
