Introducing Cloudflare’s 2024 API security and management report
Jan 9, 2024John Cosgrove, Sabina Zejnilovic
Summary
This post introduces Cloudflare's 2024 API security and management report, which is based on real traffic data rather than user surveys. It highlights the significant discovery of 'Shadow APIs' (30.7% more endpoints found via ML-based discovery than self-reported) and emphasizes the importance of accurate API inventories. It also details best practices for API rate limiting, recommending session IDs over IP addresses and suggesting HTTP 429 as a response code. The post also stresses the need for WAF protection for APIs against OWASP Top 10 style attacks and provides statistics on common API threats seen by Cloudflare's WAF.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack