I have a website and i want to consume public API from third party services such as Zoopla, weather etc.

I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd party services.

What are the security checks/best practice i should consider when using any 3rd party public API?

I am using AWS API Gateway.

  • 3
    That is highly dependant on what you actually consume. Let's say you consume an array of JSON data. There is basically no way for this to be malicious, other than the data being wrong. If you consume JavaScript code, which you then execute, the story is different. – MechMK1 Aug 2 at 17:53

Unrelated of consuming an API or accepting user input, it is good practice not to trust the data without checking it.

Therefore you should validate, that the data looks like whatever you expect it to be.

To mitigate a MITM intercepting and changing data, you should use TLS (assuming you'll ingest the data over http(s)).


Here are a few tips:

  • Check if there have been any major security issues with the third party API you are using
  • Threat the data coming in from the API the same as you would treat any user input
  • Make sure the third party supports TLS
  • we can establish TLS and ensure data input (file type, etc) is as expected. But malicious code can still arrive in the expected format. Is it common practice to install AV or WAF for any content coming in? Or is this an over the top security measure? – Architect Aug 2 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.