API Security in REST vs SOAP

By Paul Bruce

Web application and API security is paramount to digital exchanges in the connected world: the balance transfer you just made from your bank's mobile app, those notes your doctor just entered in during your check-up, the password you just sent over SMS;  they all need to be secure, and they all use APIs to transfer over the internet. And your API better be secure.

Securing Your API - What To Do

There are standards for making sure the information is safe in transit (SSL) and when stored (PCI, SOC, ISO), but where are the standards around the surface area that APIs represent? We want to expose our data, but not the wrong data and never to the wrong people. APIs are now part of our front-line defense layer and we need to treat it with the same concern and specificity as we do any other security risk.

Two types of APIs dominate the landscape: SOAP and REST web services. SOAP, while implemented widely in the enterprise, is ceding ground to the modern REST pattern for web services. Both expose data over HTTP requests and responses, but use vastly different formats and semantics to do so, and therefore have different security considerations you should pay attention to.

Over the years, SOAP has added extensions to deal with transactional messaging specific security considerations. SOAP has been around long enough and has been adopted by large enterprises such that it benefits from OASIS and W3C recommendations. Mainly, XML-Encryption, XML-Signature, and SAML tokens help to tighten up the security story over the data being received by and sent from a SOAP service.

REST on the other hand does not implement any specific security patterns, mainly because the pattern focuses on how to deliver and consume data, not how to build in safety into the way you exchange data. Proper amounts of security in code, deployment, and transmission should be determined by those implementing REST architecture patterns, not presumed as something that comes out-of-box.

This doesn't stop agencies like the NSA from doing just that, coming up with their own security practices over building and consuming data from RESTful services. And so should you, but you're not alone in this.

The New Standard of API Security

We at SmartBear have been in the API space for a decade, learning from our customers and community, teaching and training people to be successful with their APIs, and we know why security is often overlooked or under-prioritized. The problem is time. It takes time to be a security expert, and it takes confidence to stand up and say that something you're about to ship is unsafe. But we must.

API security testing has been a part of the SmartBear quality strategy for years, implemented as security tests within SoapUI, and now part of the Ready! API platform covers both SOAP security and REST security. But what are some differences between testing the security of a REST service and a traditional SOAP web service?

It comes down to semantics and format, since the transfer protocol (HTTP) is the same between the two models. A few specific examples of things that traditional security auditing doesn't cover:

• SOAP expects a request payload (XML envelope), so let's try to exploit that trait with massive improperly formatted data, or even a massive amount of data in one request
• SOAP infers that an XPath parser is on the back-end, so let's try to use some bad XPath to inject known exploits for common XPath libraries
• REST relies heavily on the HTTP method to route and process endpoint requests, but what happens if we use the wrong HTTP method on a URI? Does the server expose error details, does it take longer to handle the exception, does it allow the operation when it shouldn't?
• REST is often combined with JSON formatted messages, which just like XML, maintain a specific document/object structure. What happens if that format is broken?
• REST, when using JSON, expects properly typed data, so what happens if you use incorrect data (like a string where a number should be)? Does it have proper server-side data validation, and what kind of error details are exposed when improper details are presented to the service?
• REST and OAuth are kind of natural pals, but what if there are weak semantics in OAuth?

Are these specific exploits in any standard (like OWASP)? Is it fair to expect compliance bodies to keep up with the world of APIs? Do we have the luxury of not keeping up with security compliance over APIs?

The answer to all of these questions is "no." In reality, you are ultimately responsible for providing safe APIs. But don't be too worried, we've been thinking about this problem for a while. SmartBear's Secure Pro tool in the Ready! API Platform provides specific REST and SOAP security tests out-of-box. That means you can run detailed security checks right along in your existing continuous delivery process without expert knowledge in the security space.

In the end, we want you to ship accurate, safe, and scalable APIs. SoapUI NG Pro is the API industry's #1 open source based functional testing tool, and in the same Ready! API platform you can find professional security testing for REST and SOAP web services with Secure Pro. Try it yourself to see how safe your APIs are today!