Exam 350-401 topic 1 question 457 discussion

A is the Answer. Here's the list of best practices in securing RESTful API. 1. Always Use HTTPS - Traffic must be encrypted 2. Never expose information on URLs - as this can be captured in web server logs, which makes them easily exploitable. 3. Consider Oauth 4. Adding Timestamp in Request - This will prevent very basic replay attacks from people who are trying to brute force your system 5. Input Parameter Validation - Put strong validation checks and reject the request immediately if validation fails. 6. Use Auditing and Logging - Any subject or entity can be audited

https://hakin9.org/how-to-secure-your-rest-api-from-attackers/

A is correct

Answer A: Adding Timestamp in Request Along with other request parameters, you may add a request timestamp as an custom header in API requests. The server will compare the current timestamp to the request timestamp and only accepts the request if it is within a reasonable timeframe (30 seconds, perhaps). This will prevent very basic replay attacks from people who are trying to brute force your system without changing this timestamp.

adding timestamp will prevent basic reply attack