Skip to main content

Protect APIs with Threat Protect

When setting up a Threat Protection HTTP proxy for protecting an API service, we suggest the following best practices:

  1. Use TLS with one certificate per subdomain - ideally use our Let’s Encrypt cert management tool which is more secure, auto-renewed every 30 days, and you can have as many as you like.
  2. Always redirect HTTP to HTTPS to prevent accidental endpoints being exposed over plain text HTTP
  3. Similarly enable HSTS as well if the API is being used by browsers.
  4. Enable WAF in Blocking mode as soon as possible after having tested and tuned in Logging mode. A lot of malicious API requests are captured by our WAF and you risk leaving a large attack surface open by not enabling it.
  5. Restrict access on backend server to BBN south prefixes, i.e. only allow traffic from BBN to your backend.
  6. Enable rate-limiting to prevent malicious attempts at overloading your API servers.