SECURITY OF REST API: THREATS AND PROTECTION METHODS (Information systems and technologies security, 2025)
B a c k g r o u n d . The increase in malicious activity in the information space creates additional challenges for organizations that use REST APIs to transfer data and facilitate interactions with clients and partners. According to statistics, over 80% of modern web traffic goes through web APIs, making them an attractive target for cybercriminals. Vulnerabilities in REST API authentication and authorization mechanisms can lead to data breaches, financial losses, and reputational risks. Therefore, ensuring REST API security is a critical task for modern companies, especially those operating in high-risk industries.M e t h o d s . Threat analysis and risk assessment methods were used to evaluate the security challenges associated with REST APIs.R e s u l t s . Organizations are investing significant resources in the development of REST API security technologies, implementing tokens for access control, encrypting data transmission via TLS/SSL, and integrating modern security measures into their applications. However, research shows that major security threats remain relevant due to insufficient input validation processes, weak passwords, and the lack of multi- factor authentication. It was also found that a significant number of APIs lack rate limiting, making them vulnerable to resource exhaustion attacks (DoS/DDoS attacks).С o n c l u s i o n s . One of the key approaches to addressing REST API security issues is the implementation of an API security management system that uses a multi-layered approach to protection. This includes access control, token-based authorization, regular system vulnerability checks, and rate limiting to reduce the risk of denial-of-service attacks. In addition, implementing modern security practices, such as multi-factor authentication, will help minimize the risk of unauthorized access. The research findings can be used to improve existing REST API security policies and optimize threat management approaches in companies of various sizes.
Keywords: REST API; information security; authentication; authorization; threats