If my Restful Flask API doesn't need user login, then are the following features enough for the API security:

  1. There is only a get method in my API, no put/delete methods.
  2. Queries are parametrized for MySQL.
  3. User inputs are santized.

Have I missed out something, If yes, please suggest.

  • When you say it 'doesn't need user login', do you mean that all the information provided by the API is public and non-sensitive? – JimmyJames Apr 5 '19 at 19:31
  • @JimmyJames: Thank you for replying, Sir. Fetching only that data which is non-sensitive, and yes publicly available, for AP1. In case of API2 which fetches/puts sensitive data is authenticating user key. And the question I have asked refers to API1. – ksalf Apr 5 '19 at 19:36

No one will be able to tell if this is secure. All I can offer is some advice on other things to consider:

  • path traversal - If you have any support for loading files or templates you need to consider this. For example: verify that things like .. cannot be used to move up the file directory towards root

  • templates - if you are using templates, anything that comes from the client or is derived from client input that is passed to a template is a risk

  • string concatenation - parameterized queries are a good thing but if you are building the queries dynamically it defeats the purpose.

And of course you need to make sure your server is set up to run in production. Specifically, Werkzeug is not considered production-ready and you need to find a more robust WSGI server. You will probably want to run a reverse proxy such as NGINX or httpd as well.

| improve this answer | |
  • Very sorry, Sir, I did not put entire details while questioning. I am using nginx as a reverse proxy. Using https for json data transfer between client to server, for sensitive data. However, inside both the API, I have written only only a get method and I, being a noob, believe that API part is at least secure, as nobody could alter the state of my Database...since there are no put/delete and user inputs are properly santized too. – ksalf Apr 5 '19 at 20:02
  • So your get methods only do SQL queries? I'm not sure what sanitization means here. If you are using parameterized queries, what is being sanitized exactly? – JimmyJames Apr 5 '19 at 20:05
  • Yes Sir, the get methods inside the class in API do only sql queries and return data. Have used marshalling properly, so only that particular fields could be returned. User inputs are sanitized, the input that user sends through input box. – ksalf Apr 5 '19 at 20:08
  • How are you sanitizing them exactly? – JimmyJames Apr 5 '19 at 20:19
  • on a side note, don't get hung up on things I mentioned you are already doing, answers can be useful to others with similar questions so I try to at least touch on any important points for completeness. – JimmyJames Apr 5 '19 at 20:33

Sanitizing input is (most of the times) not enough on it's own - on top of what JimmyJames wrote, I'll also add Output Escaping & Encoding. Many developers I come across think sanitizing user input is sufficient but it is not. I recommend you read more about XSS attack mitigation. OWASP can be a great starting point. In addition, I want to make sure you address all input sources, such as SQL database, APIs and other websites as untrusted data source, therefore you consider its input as "user input" which must be sanitized before use.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.