How to secure a REST API?
如何確保 REST API 安全？
All APIs must be secured through proper authentication and monitoring. The two main ways to secure REST APIs include:
1. Authentication tokens
These are used to authorize users to make the API call. Authentication tokens check that the users are who they claim to be and that they have access rights for that particular API call. For example, when you log in to your email server, your email client uses authentication tokens for secure access.
2. API keys
API keys verify the program or application making the API call. They identify the application and ensure it has the access rights required to make the particular API call. API keys are not as secure as tokens but they allow API monitoring in order to gather data on usage. You may have noticed a long string of characters and numbers in your browser URL when you visit different websites. This string is an API key the website uses to make internal API calls.
必須透過適當身分驗證與監控確保所有 API 的安全。保護 REST API 的兩個主要方法包括：
1.身分驗證字符
這些字符是用於授權使用者進行 API 呼叫。身分驗證字符會檢查使用者是否為他們所自稱的使用者，以及他們對於該特殊 API 呼叫是否擁有存取權限。舉例來說，當您登入電子郵件伺服器，您的電子郵件用戶端會使用身分驗證字符進行安全存取。
2.API 金鑰
API 金鑰可驗證進行 API 呼叫的程式或應用程式。它們可識別應用程式，並且確保其擁有進行特殊 API 呼叫所需的存取權限。API 金鑰並不如字符安全，但是它們可允許 API 監控以便根據用法收集資料。當您造訪不同網站時，您可能會注意到瀏覽器 URL 中存在有長字元與數字字串。此字串是網站用來進行內部 API 呼叫的 API 金鑰。