API and web service

The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.

Specific controls in this category address input validation by service type such as XDS schema validation for SOAP web services or Denial of Service protection for graphQL APIs.

• Validate SOAP content type
  Use the glide.soap.require_content_type_xml property to enable validation of a content type as text/xml and protect against invalid SOAP requests.
• Prevent OAuth Clients from Using Implicit Grant
  Use a system property to avoid the use of the implicit grant type.
• Require authorization for PDF requests
  Use the glide.basicauth.required.pdf property to designate if incoming PDF requests should require basic authentication.
• Require Authentication on Event Management HTTP Processor [New in Security Center 1.3, Updated in 1.5, and removed in 2.0]
  Learn how to establish secure basic authentication for inbound Amazon Simple Notification Service (SNS) requests when the Event Management plugin (com.glideapp.itom.snac) is enabled.
• Require authorization for SOAP requests
  Use the glide.basicauth.required.soap property to designate if incoming SOAP requests should require basic authorization.
• Require authorization for unload requests
  Use the glide.basicauth.required.unl (useUnloadFormat) property to designate if incoming unload requests should require basic authentication.
• Require authorization for csv requests [Updated in Security Center 1.3]
  Use the glide.basicauth.required.csv property to designate if incoming CSV (Comma-Separated Values) requests should require basic authentication.
• Require authorization for excel requests
  Use the glide.basicauth.required.excel property to designate if incoming Excel requests should require basic authentication.
• Require authorization for import requests
  Use the glide.basicauth.required.importprocessor property to designate if incoming import requests should require basic authentication.
• Require authorization for JSONv2 request
  Use the glide.basicauth.required.jsonv2 property to designate if incoming JSONv2 requests should require basic authorization.
• Require authorization for WSDL request
  Use the glide.basicauth.required.wsdl property to designate if incoming WSDL (Web Services Description Language) requests should require basic authentication.
• Require authorization for XML requests
  Use the glide.basicauth.required.xml property to designate if incoming XML requests should require basic authentication.
• Require authorization for XML output requests
  Configure this property so that basic authorization is required for all inbound XMLOutputProcessor requests.
• Require Authorization for XSD Requests
  Use the glide.basicauth.required.xsd property to designate if incoming XSD (XML Schema Definition) requests should require basic authentication.
• Require authorization for script requests
  Use the glide.basicauth.required.scriptedprocessor property to designate if incoming script requests should require basic authentication.
• Require authorization for SCHEMA requests
  Use the glide.basicauth.required.schema property to require basic authorization for all Inbound Table Schema Processor requests.
• Require authorization for RSS requests
  Use the glide.basicauth.required.rss property to designate if incoming RSS requests should require basic authentication.
• Require authorization for API requests
  Use the glide.basicauth.required.api property to enhance security for basic authorization for incoming REST requests.

Parent Topic:Hardening settings