Introduction to REST API security
68 minutes on why the controls that protect your website don't cover your REST APIs, what attacks them instead and which defenses actually help. Told from the field, including a stint at 42Crunch. Taught in Spanish.
With Daniel Alfocea
- of video
- 68 min
- videos
- 8
- level
- introductory
In Spanish. This program is taught in Spanish: its videos, exercises and exam are in Spanish. This page is a translation to help you decide.
Who it is for
You work in security, architecture or backend, you already have REST APIs in production and can't quite see why the controls you've maintained for years don't cover them. You don't need to know anything about API security.
About the program
Everything was green the night before
68 minutes on why the controls that protect your website don’t cover your REST APIs, what attacks them instead and which defenses actually help. For people who already have APIs in production.
Language: the course is taught in Spanish. The videos, the slides and the exam are in Spanish. This page is the English description only.
Let me explain.
You have a WAF in front. ModSecurity with the OWASP CRS loaded. You filter by IP, apply throttling, do fingerprinting and run code analysis. The inventory of all that, if you’re like most people, lives in a spreadsheet.
And one morning you wake up to a compromised company.
It turns out that an API and a website only share the transport. HTTP, and that’s it. They break in places your dashboard doesn’t watch, and what it takes to defend them isn’t on your list of controls. What you’ve been paying for years was designed for HTML pages built on the server, and your API doesn’t return HTML to anyone.
That’s where the things nobody is watching get in.
Who is telling you this
My name is Daniel Alfocea. I’ve spent twenty years in development and security. I’ve worked for IBEX 35 banks and for companies in the United States, the United Kingdom and India, and I’ve given talks at Navaja Negra and OWASP Madrid.
What’s in this course comes from a specific stint: I was a product lead at 42Crunch, a company dedicated only to API security. There I saw from the inside what breaks in large companies’ APIs, how often the same flaw repeats and which defenses are still standing when someone really pushes.
I tell you this for transparency, not to sell you anything. Inside I name tools, including theirs, and I also say where they fall short. If you were looking for a commercial demo, this isn’t one.
What you get
Things like these:
The field someone adds to a PUT that makes them an administrator, without touching a single line of your permissions code. It happens because of how your ORM is used, and it’s among the most repeated flaws there is.
What you’re telling whoever is testing you every time you return a status code. You tell them more than you think, and almost always for free.
Why an OWASP CRS rule never gets to see the attack, even when it arrives inside the request the rule just let through.
The question almost no company can answer on the spot: how many APIs it has published right now. And the one that really stings: how many live endpoints there are that nobody registered.
Why serving a static file from your API ends up on your autoscaling bill, and what to put in its place.
Which code to really audit, because the hole is rarely in the code you wrote yourself.
The two approaches an API-aware WAF uses to discover what you have published, how they differ and which fits you depending on how well documented your house is.
The response check almost nobody does: that it returns those fields and not one more.
How to get the definition of your API when nobody ever wrote it. There are four paths, each with its price, and one of them will give you different results every time you run it.
None of the answers are on this page. They’re all inside the course.
The syllabus, lesson by lesson
It’s 68 minutes of video in 8 lessons, plus the PDF with the full slides and a final exam with a certificate.
1. General concepts (4 lessons, about 21 minutes)
- What an API shares with a traditional website, which is less than it seems.
- Where I’m telling you this from, including my time at 42Crunch, and why this isn’t a sales talk.
- Anatomy of a breach: every control in place, the WAF green and the company compromised anyway.
- The attacks that do show up against an API: mass assignment and the privilege escalation that comes with it, what response codes reveal, why classic SQL injection has less surface here, where to really audit, and what happens when your API serves files.
2. Protection measures (2 lessons, about 25 minutes)
- Why a traditional WAF doesn’t protect an API. Everything is decided at JSON deserialization, and in what happens to a CRS rule when the object is nested.
- WAFs that do understand an API: those that deserialize and walk the model level by level, their two ways of discovering what you have, the API key versus IP filtering, what to expect from static analysis and what to check in the response.
3. Good practices (2 lessons, about 22 minutes)
- API governance: knowing how many you have, Shadow IT at the endpoint level, the repository even if it’s just a Postman collection, versioning and a deprecation policy you can actually keep. With a warning about what it costs to be the team that only says no.
- Getting the specification when nobody has it. RAML, Swagger, OpenAPI 3 and Postman, why OpenAPI 3 has become the de facto standard, and how to deduce yours from what is already running.
4. Additional resources
The full slides of the course as a PDF, to consult without going back to the video.
5. Exam and certificate
Fifteen questions on what you’ve seen. You pass with 70 and there are two attempts. When you pass, the certificate is issued with its public verification code.
What it costs and why
€99, one payment, lifetime access. When I update the course, you get the new version without paying again.
It’s 68 minutes and it won’t make you an API security expert. Anyone who sells you the opposite for €99 is lying to you. This is an introduction, and it’s recorded as one.
What you get for that money is the map. Leaving knowing why your current controls don’t cover what you thought, what people will try against you, which defense does something real and in what order to tackle it. With that you stop paying for tools that look in the wrong place.
An hour of security consulting costs you more than €99, and it still hasn’t told you where to start. An incident costs quite a lot more than the consulting.
You also join the community, where questions that don’t fit in a video get answered. And you write to me if you get stuck.
If it still seems expensive, don’t buy it. A course bought grudgingly goes unwatched, and then you really have thrown away 99 euros.
Cheers,
Dani
P.S. Try this before you decide. Ask right now at your company how many APIs are published in your name. If you have to ask three people and still don’t get a number, lesson seven is exactly about that, and it’s the one that goes down worst of the eight.
Syllabus
68 minutes of video in 8 lessons, plus the PDF with the full slides and a final exam with a certificate. The ones marked “Sample” can be watched without logging in.
01Conceptos generales 4 lessons
- Las APIs no se protegen como una web
- De qué va esto y desde dónde lo cuento
- Anatomía de una brecha con todas las capas puestas
- Ataques típicos contra una API REST
02Medidas de protección 2 lessons
- Por qué un WAF tradicional no protege una API
- WAFs para APIs y los mínimos exigibles
03Buenas prácticas 2 lessons
- Gobierno de APIs: inventario, versionado y deprecación
- Conseguir la definición cuando nadie la tiene
04Recursos adicionales 1 lesson
- Diapositivas completas del curso
05Examen y certificado 1 lesson
- Examen de certificación
Sample lessons
Watch them before you pay.
-
Las APIs no se protegen como una web
-
De qué va esto y desde dónde lo cuento
Who teaches it
Daniel Alfocea
Twenty years in development and security, and a stint as product lead at 42Crunch.
Reviews
Como siempre directo al grano y claro
Questions
Are 68 minutes worth €99?
It depends what you compare it with.
An hour of security consulting costs more than this, and you leave still unsure where to start. Here you leave knowing which of the things you already pay for aren’t covering your API, what people will try against you and in what order to tackle it.
What you won’t find is a long course with labs and twenty examples per technique. It’s 68 minutes, straight to the point. If you want a thirty-hour course with guided practice, this isn’t the place.
Will I come out an API security expert?
No, and I’d rather tell you before you pay. It’s an introduction and it’s recorded as one.
What you get is the map: why what you have in place fails, which attacks really show up against an API, which defenses do something and which only look like they do. The fine work comes later, but at least you know where to dig.
Is this advertising for 42Crunch?
No, and I say so inside the course itself.
I was a product lead there, so it would be odd not to mention it: a good part of what I know about this I learned looking at their customers’ APIs. I name their tools where relevant, just as I name other people’s, and I also say where they fall short.
If you were expecting a product demo, you’ll be disappointed.
Is it for security people or for developers?
For both, and that’s half the point of the course.
If you come from security, you’ll understand why your WAF and its rules don’t cover what you thought, and why the API inventory is the groundwork everything else hangs from. If you come from backend, you’ll understand what you’re exposing without realizing it, starting with what you return in excess in every response.
It works just as well if you lead architecture and need to decide where to put the money.
Do I need to write code to follow it?
There are no programming exercises. Code is discussed and shown, so you’ll follow much better if you’ve written an API before.
If you’ve never touched one and don’t know what a PUT is, some parts will stay out of reach.
My API isn't REST, it's GraphQL or gRPC. Does it work for me?
Partly, and I’ll tell you where the line is.
Everything about governance, inventory, versioning, deprecation and what to expect from a WAF or static analysis applies just the same. The concrete examples are REST over JSON, and some details change from one protocol to another.
If you have both living together, which is the usual case, you get the whole course.
We already have OpenAPI. Can I skip the last module?
That module is about how to get the definition when you don’t have one, so you’ve already won that. Congratulations, because it’s the part that’s hardest to swallow.
The rest of the course is still useful to you, and that foundation is exactly what makes a good part of module 2 useful. Having the definition doesn’t mean the work is done, but without it you can’t even start.
What if it's not useful to me afterwards?
Above you have, in full detail, what’s inside and who it’s meant for. It’s written so you back out if you don’t recognize yourself there.
The terms of purchase say what happens after you buy. They’re in the footer and in the checkout itself.
Who it is forYou work in security, architecture or backend, you already have REST APIs in production and can't quite see why the controls you've maintained for years don't cover them. You don't need to know anything about API security.