README.md

Optional Exercise 02 - API Security Best Practices

We've covered different policies during this CodeJam but it will be impossible to cover every single policy type that's available in SAP API Management. That said, it is still good to be familiar with what's available as every company/project has different requirements/needs that we might need to address via API policies.

At the end of this exercise, you'll be familiar with different API Security Best Practices and examples that are available in SAP Community.

Best Practices

I want to bring to your attention a wonderful blog post series that was published by Divya Mary and Sven Huberti in SAP Community. In the blog post series, she goes through the details of different policy types and best practices that you can apply in SAP API Management to protect your APIs.

Different API policies covered in blog post series

Below is a list of the different policy types and examples of how to use them.

Although the screenshots in the blog post series are from a previous version of SAP API Management but the logic behind applying the policies is still valid.

Policy Type	Example
Access Control	Part 1 – Restrict access to API based on IP Addresses
Quota	Part 2 – Rate limit API calls with Retry time
Javascript, Quota	Part 3 – Rate limit API calls for OData Batch calls
XSL Transform	Part 4 – Data masking of sensitive data from API response
JSON Threat protection	Part 5 – JSON Threat protection against injection attacks
XML Threat protection	Part 6 – XML Threat protection against injection attacks
Message Logging	Part 7 – Log all API interactions
Regular Expression Protection	Part 8 – Threat protection against SQL injection attacks
Quota per application	Part 12 – Rate limit API call per developer

Summary

Now that you are familiar with the basic functionality of SAP Business Accelerator Hub and the Business Partner API, we are ready to start interacting with the services from which our integration will be extracting data.

Further reading

• API Security Best Practices Blog Series

---

If you finish earlier than your fellow participants, you might like to ponder these questions. There isn't always a single correct answer and there are no prizes - they're just to give you something else to think about.

1. Can you think of any APIs, that you've interacted with, that have similar security best practices?
2. Are there any API projects, that you've been involved in, where an API policy could have simplified the implementation?