Mejores prácticas de seguridad en APIs: estrategias para la protección de servicios Web

Abstract

Abstract: In today's digital environment, the design of Application Programming Interfaces (APIs) must ensure both scalability and security to enable seamless integration between systems. However, their widespread adoption has expanded the attack surface, exposing organizations to significant risks. In this context, organizations such as OWASP highlight that most data breaches result from failures in authentication and authorization. The main objective of this research is to identify critical threats in these services, develop an API Prototype, and evaluate the effectiveness of the implemented solutions. The methodological approach was quantitative, based on the collection and analysis of data obtained through static and dynamic security testing. For this purpose, specialized tools such as CodeQL and Postman were utilized. The results validated that the implementation of measures including token-based authentication, Role-Based Access Control (RBAC), Bcrypt encryption, rate limiting, and input sanitization effectively mitigates the vulnerabilities identified in the OWASP API Security Top 10 2023. It is concluded that adopting these best practices is essential to ensure confidentiality, integrity, and availability in modern web services.