OpenAPI Extended Security Scheme: A Method to Reduce the Prevalence of... Daniel Cozma & Rami Haddad
OpenAPI Extended Security Scheme: A Method to Reduce the Prevalence of Broken Object Level Auth - Daniel Cozma & Rami Haddad, Cisco
The Open API Specification’s (OAS) security properties do not provide the capability to implement any form of authorization. This leaves access control implementation at the mercy of developers which presents an increased risk of attack vectors being created unintentionally. We aim to tackle this void by introducing 1) the OAS ESS (OpenAPI Specification Extended Security Scheme) which includes declarative security controls and an authorization module that can be imported to API services (Flask/FastAPI) to enforce authorization checks. When building an API service, a developer can start with the API design (specification) or its code. In both cases, we provide a set of mechanisms to help developers write secure APIs.
Security vulnerabilities are as much a human problem, as a technical problem. It is not feasible to achieve a best-practice scenario, in which every developer is thoroughly aware of application security and ensures that code is constructed securely. However, it does minimize the risk significantly when developers can define security logic declaratively. In doing so, the complexity of authorization is to be taken to the background of the respective programming environment.
We will speak about writing more secure APIs in design-time, and during code-construction for run-time security all whilst adhering to OAS principles.