Regarding API security issues, mainly the following issues
1. Identification.
This can use the Oauth 2.0 specification, or token with asymmetric key encryption, choose JWT and other forms, and cooperate with the identity authentication system to ensure.
Second, the content is tamper-proof.
A digital signature algorithm can be used for hash verification to force HTTPS communication. The latest systems can consider http/2.
3. DDoS attack.
Communicate and control by setting firewalls, controlling the frequency of API calls, such as the rate-limit of the protocol and other settings.
4. Injection attacks. This needs to start from input verification, encoding and decoding, input filtering and conversion. Mainstream frameworks have basic anti-injection designs.
5. Same-origin policy.
Prevent abnormal calls by configuring CORS correctly, but it is only valid for browsers. For the mobile terminal, the valid call source can be verified by distributing certificates or tokens.
6. Man-in-the-middle attack.
This seems to be a good way to think of it. It can only remind the user that they are in an unsafe network at the calling end, and there is a risk of attack and avoid it by themselves.