Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the data.
- The API / database has no private information. All information is available and none of it is PII etc. It wouldn't be a problem for me if someone read all the data.
- Currently the API is a Sinatra app and it does have write methods so I can add data, protected by HTTP Auth.
- It will be hosted on Heroku and served via HTTPS only.
- The data will not change frequently.
- The data will be backed up on a regular basis so even a destructive break-in wouldn't be the worst thing in the world.
- Are there specific areas I should read up about security-wise in this situation?
- Would moving the API write methods (and admin) to a completely different app and then simply syncing the database handle most security issues?
- Is HTTP Auth sufficiently secure with a long username and password or is there a better method than HTTP Auth for authorizing myself in the admin?
(Note: I have looked for related questions and found this: Is BASIC-Auth secure if done over HTTPS? but it's not really clear if there's a better option or method that doesn't open up even more security implications)
- Any other tips or thoughts?
I'm a bit out of my element currently and I want to get this project shipped, rather than lingering too long. I'm sure there's no replacement for proper application security training but I'm hoping because of the public nature of the data, I can ignore a majority of security situations to start and spend more time learning about them later.