Describe REST API security

📘CCNP Encore (350-401-ENCORE-v1.1)

---

1. What is a REST API?

• REST (Representational State Transfer) is a way for two systems to communicate over the network using HTTP(s).
• In networks, REST APIs allow automation tools to read information from devices (GET), send commands (POST), update configurations (PUT/PATCH), or delete resources (DELETE).

---

2. Why is REST API Security Important?

REST APIs expose the network devices and controllers to network clients. Without security, anyone could:

• View network configuration.
• Change device settings.
• Launch attacks or disrupt services.

So, securing REST APIs is critical for protecting devices and the network.

---

3. Common REST API Security Mechanisms

a. Authentication

Authentication ensures only authorized users can access the API. Common methods:

1. Basic Authentication
   • User provides a username and password in the request.
   • Example: Authorization: Basic base64(username:password)
   • Weak unless used with HTTPS, because credentials can be intercepted.
2. Token-Based Authentication
   • Client first logs in and gets a token (like a session key).
   • Token is then used in API requests instead of sending the username/password every time.
   • Example: Authorization: Bearer <token>
   • Safer and preferred in modern APIs.
3. OAuth 2.0
   • Common in enterprise networks.
   • Provides scoped access, meaning the client can only do specific actions.
   • Tokens expire automatically, increasing security.

---

b. Authorization

• After authentication, authorization determines what the user can do.
• Examples:
  • User A can read configurations but cannot change them.
  • User B can push configuration changes.
• Proper role-based access ensures least privilege principle, reducing risk of misuse.

---

c. Encryption

• REST APIs must use HTTPS (HTTP over TLS/SSL).
• HTTPS ensures:
  • Data in transit is encrypted, preventing attackers from sniffing credentials or configuration commands.
  • Integrity – data cannot be modified while being transmitted.

---

d. Input Validation & Threat Protection

• Always validate input to prevent attacks like:
  • SQL injection (if the API interacts with a database)
  • Command injection
  • Cross-site scripting (XSS)
• Secure network devices check what commands and data are allowed before execution.

---

e. Rate Limiting and Throttling

• Protects APIs from flooding or DoS attacks.
• Example: limiting a client to 100 API calls per minute.
• Helps ensure network stability even if someone tries to abuse the API.

---

f. Logging and Monitoring

• All API requests should be logged: who accessed, when, and what operations were done.
• Helps in audit trails and detecting abnormal activity.
• Example: In Cisco DNA Center, every REST API call is logged for troubleshooting and security review.

---

g. API Keys (Optional)

• Some REST APIs use API keys as a simple access mechanism.
• Example: A key is generated per application and sent in the header: x-api-key: <key>
• Should be combined with HTTPS and, ideally, token-based auth for security.

---

4. Best Practices for REST API Security

For CCNP exam purposes, remember these must-know best practices:

1. Always use HTTPS. Never use HTTP for production APIs.
2. Use token-based authentication or OAuth, not plain username/password.
3. Implement role-based authorization to control user privileges.
4. Validate all input and sanitize outputs.
5. Implement rate limiting to prevent DoS attacks.
6. Log all API access for audit and monitoring.
7. Regularly rotate API keys or tokens.

---

5. Cisco-Specific Notes for the Exam

• Cisco network devices (IOS-XE, IOS-XR, NX-OS) and Cisco DNA Center support REST APIs with HTTPS and token-based authentication.
• Some Cisco controllers require you to generate a session token before using the API.
• Example:
  • Send POST request to /api/v1/auth/token with username/password.
  • Receive token → use Authorization: Bearer <token> in subsequent requests.

---

6. Summary Table for Easy Memorization

Security Feature	Purpose	Cisco Example
Authentication	Verify user identity	Basic auth, token, OAuth
Authorization	Determine user privileges	RBAC on DNA Center API
Encryption	Protect data in transit	HTTPS (TLS/SSL)
Input Validation	Prevent malicious commands	Cisco APIs sanitize commands
Rate Limiting	Avoid API flooding	100 calls/min limit
Logging	Audit and monitoring	DNA Center logs API calls
API Keys	Identify applications	x-api-key header

---

✅ Key Exam Tip:
The exam will test how REST API security works in networking environments, not deep programming. Focus on:

• HTTPS usage
• Token or OAuth authentication
• Role-based authorization
• Logging and rate-limiting

---