I need resources for API security basics. Any suggestions? (This is my first serious programming job. Please help.)

Question

I've done a little googling but have been a bit overwhelmed by the amount of information. Until now, I've been considering asking for a valid md5 hash for every API call but I realized that it wouldn't be a difficult task to hijack such a system. Would you guys be kind enough to provide me with a few links that might help me in my search? Thanks.

Answer 1

First, consider OAuth. It's somewhat of a standard for web-based APIs nowadays.

Second, some other potential resources -

A couple of decent blog entries:

• http://blog.sonoasystems.com/detail/dont_roll_your_own_api_security_recommendations1/
• http://blog.sonoasystems.com/detail/more_api_security_choices_oauth_ssl_saml_and_rolling_your_own/

A previous question:

• http://stackoverflow.com/questions/1257085/good-approach-for-a-web-api-token-scheme