14

What security issues could arise from leaving the Swagger pages on production APIs that expose sensitive data (albeit secured with OAuth)? Are there web crawlers that look to harvest Open API definition files (i.e swagger) for nefarious means?

1

2 Answers 2

16

Publicly documenting your API gives attackers a head-start in identifying possible ways to abuse the API.

If you expect to host a functional Swagger UI page, ensure that your API's Cross-Origin Resource Sharing policy is not overly permissive, and that you have Cross-Site Request Forgery protections in place.

Similarly, take care to defend the Swagger UI page against frame-jacking, e.g., via the X-Frame-Options header.

Aside from those, consider these other business-related risks:

  • your API document is a reflection of your organization, and so should not contain things like profanity
  • your API may reveal exactly what sort of sensitive data it handles
    • social security numbers and other PII would be a big draw for attackers
  • your API may reveal your organization's business connections, for better or worse
    • for example, if your API document includes a query parameter named "exclude_data_we_stole_from_the_fbi", you may attract attention from the FBI for stealing their data
  • the frequency of updates to your API may signal your development or maintenance velocity to your competitors
2
  • 2
    Not including swagger will in no way even slow down someone intent on abusing your API. It should still require authentication and your validations and restrictions should already be ensured on the server/database. “Security” though obscurity is not security. Feb 4, 2022 at 9:51
  • 1
    @MatthewWhited it's correct that hiding the API is security through obscurity, but expose SwaggerUI web application to Internet only increases the attack surface unnecessarily
    – user23179
    Oct 13, 2022 at 23:09
2

I would assume the primary reason for leaving swagger pages on in production is because you already have a public API in the first place and want an easy way to document it.

With that being the case, a primary concern of leaving the swagger pages exposed is any security flaw in the swagger pages themselves may allow them to gain some information or access to the host that also hosting the APIs, i.e. increasing attack surface.

You could mitigate this risk by requiring authorization to the swagger pages themselves.

You could eliminate this risk by having separate hosts for displaying the swagger pages vs API endpoints.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .