When designing an API, it is easy to overlook security and reliability. Below are six common issues that negatively impact services and users.
1. Passing parameters via GET
When sensitive data (such as passwords or card numbers) appears in the URL, it gets stored in server logs and browser history, and can be exposed to prying eyes. Therefore, for any sensitive data, use POST or PUT and transmit the information in the request body over HTTPS.
2. Sending a secret key with every request
If a client sends the same key every time, it is easily stolen or intercepted. Instead, we use an encrypted signature: the key itself is never transmitted; rather, each request is signed using it. The server verifies the signature without ever receiving the actual key, thereby reducing the risk of theft.
3. Storing keys in plaintext in the database
Storing keys or passwords in plaintext in a database is dangerous; if the database is compromised, an attacker could send requests on behalf of users. Consequently, the database should only store hashes or encrypted values from which the original secret cannot be recovered.
4. Lack of protection against race conditions
Simultaneous requests can lead to double charges or other errors. A nonce won't help here—it protects against replay attacks but not race conditions. We use atomic file-level protection: data validation and modification operations are performed as a single unit, ensuring that parallel requests cannot compromise data integrity.
5. No unique request identifier
If a client retries a request due to a network failure and the server fails to distinguish duplicates, the same operation might be executed twice. To avoid this, the client should send a unique identifier (such as a UUID), and the server should store it and ignore duplicate requests with the same ID.
6. JSON only supports floats
The float type is unsuitable for financial data because it leads to rounding errors (e.g., 0.1 + 0.2 = 0.30000000000000004). Monetary values should be transmitted in JSON as strings or as integers representing the smallest currency units (e.g., kopecks).
These six points represent the bare minimum needed to protect your API from the most common vulnerabilities and errors.
