Protect APIs with Threat Protect
When setting up a Threat Protection HTTP proxy for protecting an API service, we suggest the following best practices:
- Use TLS with one certificate per subdomain - ideally use our Let’s Encrypt cert management tool which is more secure, auto-renewed every 30 days, and you can have as many as you like.
- Always redirect HTTP to HTTPS to prevent accidental endpoints being exposed over plain text HTTP
- Similarly enable HSTS as well if the API is being used by browsers.
- Enable WAF in Blocking mode as soon as possible after having tested and tuned in Logging mode. A lot of malicious API requests are captured by our WAF and you risk leaving a large attack surface open by not enabling it.
- Restrict access on backend server to BBN south prefixes, i.e. only allow traffic from BBN to your backend.
- Enable rate-limiting to prevent malicious attempts at overloading your API servers.