2

We own a REST API which is consumed by machines on our own company network so we don't have any authentication right now. The plan is to expose the API to the internet using Apigee, while our internal network consumers also exist. What are the standard ways to securely know if a call was made from within the company network or outside?

Is IP based authentication a secure method to know if an API call was made from machines on internal network? Our API's are written using the .NET framework and are running on Windows Server 2008 machine.

  • What are the ramifications of an external user getting access to the internal API? – Neil Smithline Apr 2 '18 at 12:43
1

Is IP based authentication a secure method to know if an API call was made from machines on internal network?

What do you mean by secure? What happens if a machine inside the network is attacked and used as a proxy? Unlimited access to the API calls?

The REST API needs authentication and authorization before you can pretend it has any real security. Of course those need to be done correctly, but that is on the lower end of what you need.

  • This seems more like a comment than an answer. – Tom K. Apr 3 '18 at 15:02
1

It is generally inadvisable to try to control access to a networked service by such a vague means. In practical pentesting, it is not unusual for the attacker to be able to possess, say, a networked printer or coffee machine, and use that as a springboard to perform requests on your service with 'local network' privileges. On a more philosophical level, if you're trying to divide customers as 'local' and 'foreign', it indicates you have not done a proper analysis of who has need for what kind of access. Systems thrown together without systematic analysis tend to err to the side of the accessibility aspect of data security, and such errors can lead to failure, sometimes massive, of the confidentiality aspect.

If you're developing what is essentially a single service, but with more access granted to your organisation's agents than to anonymous people off the Internet, you should set up some authentication mechanism, and distribute passwords, client certificates, OTP tokens, or some other means of secure identification to those people with specific need to access data you intend to not make publicly accessible by randos. In the context of Windows-based services, your users will probably already have entries in your Active Directory, and may have been configured to authenticate against it when they login in to their workstations. If your analysis suggests this level of authentication is appropriate for your service, you may, for example, configure your web server to request that users' browsers present Kerberos tickets when accessing your service, and determine the appropriate access level based on user identity in this way.

If analysis shows that what you're trying to do is better modeled as two distinct services, you may prefer to set up one service for public access, and another for the local network, perhaps with some sort of regular data migration process between their datastores. You'd still be well-advised to authenticate the people you consider 'local' before you give them any non-public data or accept commands from them you would not want to accept from randos, of course.

1

I'm going to strictly answer only this question:

Is IP based authentication a secure method to know if an API call was made from machines on internal network?

The answer is YES, source IP addresses can be used to reliably validate whether or not traffic originated from within your LAN with the following caveats:

  • The rest API is only accessible over TCP. (UDP source IP spoofing address is more easily acheived due to the stateless nature of the protocol. Such spoofing is much less practical over TCP)
  • You do not have have exposed gateways which allow someone to pivot into your LAN, such as an open proxy, publicly accessible remote access system, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.