--- title: "API Security & Authentication: Protecting Your APIs" description: "Master API security fundamentals: authentication, authorization, OAuth2, JWT, API keys, HTTPS, rate limiting, CORS, and common vulnerabilities. Secure your APIs against attacks." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/quizzes/post/api-security-authentication-quiz --- # API Security & Authentication: Protecting Your APIs Welcome to the API Security & Authentication Quiz! This quiz will test your knowledge of key concepts and best practices for securing APIs. Each question is designed to challenge your understanding of authentication, authorization, OAuth2, JWT, API keys, HTTPS, CORS, rate limiting, and common vulnerabilities. Good luck! ## Questions ### 1. What is the difference between authentication and authorization? - Authentication verifies user identity; authorization manages user permissions - Authentication manages user permissions; authorization verifies user identity - Authentication secures data in transit; authorization secures data at rest - Authentication is for internal users; authorization is for external users **Hint:** Think about identity verification vs. permission checks. ### 2. What is OAuth2? - An authorization framework for delegating access to third-party applications - A specialized hashing algorithm for protecting passwords in a database - A transport-level encryption protocol for securing raw socket connections - A multi-factor authentication system using hardware-based security keys **Hint:** Think about delegated authorization without sharing passwords. ### 3. What is a JWT (JSON Web Token)? - A stateless, self-contained token used to securely transmit encoded data - A stateful session identifier that requires server-side database storage - A client-side cookie specifically designed for cross-domain tracking - An encrypted XML structure used for enterprise-level single sign-on flows **Hint:** Think about a token containing encoded information. ### 4. What are the three parts of a JWT? - Header (algorithm), Payload (claims), and Signature (verification) - Username (identity), Password (secret), and Token (identifier) - Request (method), Response (status), and Verification (check) - Encryption (method), Compression (format), and Encoding (type) **Hint:** Think about header, payload, and security. ### 5. What is an API key, and when should it be used? - A simple identifier for public access, basic usage, and rate limiting - A complex encrypted credential used primarily for administrative access - A dynamic token that replaces the need for HTTPS during data transfers - A required component for implementing OAuth2 authorization code flows **Hint:** Think about simple authentication for API access. ### 6. What is HTTPS, and why is it critical for APIs? - A secure transport protocol using TLS to prevent data interception - A high-speed version of HTTP that optimizes response delivery times - A token-based security standard used to manage user session states - A server-side validation technique for sanitizing incoming API requests **Hint:** Think about encrypted communication over the network. ### 7. What is CORS (Cross-Origin Resource Sharing) in APIs? - A mechanism that uses HTTP headers to allow cross-domain resource access - A security rule that automatically blocks all incoming external requests - A caching strategy used to store API responses across different servers - An authentication protocol designed specifically for GraphQL subscriptions **Hint:** Think about requests from different domains/origins. ### 8. What is rate limiting in API security? - Restricting the number of requests a user can make in a specific timeframe - Reducing the maximum size of data payloads returned by the API server - Enforcing specific business hours when the API is available for clients - A tiered billing model based on the total data consumed by an application **Hint:** Think about preventing abuse from excessive requests. ### 9. What is a brute force attack on APIs? - Attempting to guess credentials by trying many combinations in rapid succession - Injecting malicious scripts into the database to corrupt user account data - Overloading server memory by sending massive files to specific endpoints - Redirecting secure HTTPS traffic to an unencrypted and malicious server **Hint:** Think about trying many passwords/credentials rapidly. ### 10. What is injection attack vulnerability? - Inserting malicious commands through input fields to execute unauthorized code - A diagnostic tool used by developers to monitor real-time API performance - A method for securely sharing database credentials between microservices - An architectural pattern used to automatically scale server-side resources **Hint:** Think about inserting malicious code via input. ### 11. What is XSS (Cross-Site Scripting)? - Executing malicious scripts in the browser of users viewing a web page - Intercepting unencrypted data as it travels between the client and server - Bypassing the server-side firewall to access sensitive database records - A specialized encryption method used to secure cross-origin API calls **Hint:** Think about injecting JavaScript into web pages. ### 12. What is CSRF (Cross-Site Request Forgery)? - Forcing an authenticated user to execute unwanted actions on a trusted site - Scanning an API for open ports and unpatched software vulnerabilities - A technique used to crack passwords by comparing hashes to a precomputed list - A performance bottleneck caused by too many simultaneous API requests **Hint:** Think about tricking users into performing unwanted actions. ### 13. What is the principle of least privilege in API security? - Providing users only the minimum access levels required to perform their jobs - Allowing all authenticated users full access to the administrative dashboard - A method for automatically increasing user permissions during peak hours - A policy that requires users to change passwords every thirty days **Hint:** Think about giving minimal necessary permissions. ### 14. What is a refresh token, and why is it used? - A long-lived token used to obtain new access tokens without re-authenticating - A temporary credential used to reset a forgotten user account password - A security mechanism that clears the browser cache after every API logout - A specialized key used to encrypt data stored within the local database **Hint:** Think about extending sessions without re-authenticating. ### 15. What is two-factor authentication (2FA)? - Requiring two independent forms of evidence to verify a user identity - Using two different passwords to access the same administrative account - A process where two separate APIs must approve a single user request - An encryption method that applies two layers of hashing to a password **Hint:** Think about requiring two forms of verification. ### 16. What is token expiration, and why is it important? - Limiting the valid lifetime of a token to reduce the risk of misuse - The time it takes for a server to process and validate a security token - A technique for compressing tokens to reduce network bandwidth usage - A requirement that tokens be generated only during business hours **Hint:** Think about limiting token lifetime. ### 17. What is the difference between session-based and token-based authentication? - Sessions store state on the server; tokens are stateless and self-contained - Sessions are used for mobile apps; tokens are used for desktop browsers - Sessions require HTTPS; tokens can be used over unencrypted connections - Sessions use JSON objects; tokens use XML structures for data exchange **Hint:** Think about server storage and statelessness. ### 18. What is a salt in password hashing? - Unique random data added to a password before hashing to prevent collisions - A symmetric encryption key used to decode passwords in the database - A hardware device used to generate truly random numbers for encryption - A validation rule that requires passwords to include special characters **Hint:** Think about preventing rainbow table attacks. ### 19. What is the purpose of Content Security Policy (CSP)? - An HTTP header that restricts the sources from which scripts can load - A policy that defines which users are allowed to edit API documentation - A standard for encrypting sensitive content before it is stored in a database - A system for automatically translating API content into multiple languages **Hint:** Think about restricting where scripts can be loaded. ### 20. What is API versioning, and how does it relate to security? - Managing API updates to fix security flaws without breaking existing clients - Assigning a unique version number to every user for tracking permissions - A method for rotating encryption keys every time a new version is released - Restricting API access based on the version of the user's operating system **Hint:** Think about maintaining backward compatibility while fixing issues. ### 21. What is API authentication vs. authorization in microservices? - Services verify each other identities and then check specific access rights - Authentication is for external traffic; authorization is for internal traffic - Authorization verifies the service; authentication defines the data format - They are combined into a single step to optimize network performance **Hint:** Think about service-to-service authentication. ### 22. What is the responsibility of the API provider vs. client in security? - Providers secure the infrastructure; clients secure their tokens and requests - The provider is solely responsible for all aspects of the security lifecycle - The client is responsible for encryption; the provider handles user login - Security responsibilities are handled automatically by the cloud host **Hint:** Think about shared security concerns. ### 23. What is API key rotation, and why is it important? - Periodically replacing API keys to minimize damage if a key is leaked - Switching between different keys to bypass secondary rate limiting rules - A process for updating the encryption algorithm used by the API - The practice of sharing a single API key among multiple developer teams **Hint:** Think about periodically changing credentials. ### 24. What is secrets management in API authentication? - Using specialized tools to securely store and inject API credentials - The process of obfuscating code to make it difficult for hackers to read - Restricting the visibility of API documentation to authorized users only - A policy that forbids developers from discussing API security protocols **Hint:** Think about storing credentials securely outside code. ### 25. What is mutual TLS (mTLS) authentication? - A process where both the client and server verify each other certificates - Using two different encryption layers to protect a single API connection - A method for synchronizing time between a client and a security server - An authentication flow that requires a user to enter two different passwords **Hint:** Think about both client and server verifying each other. ### 26. What is the difference between public and private APIs? - Public APIs are open to external users; private APIs are internal only - Public APIs use JSON; private APIs use binary formats for data transfer - Public APIs require no security; private APIs require full encryption - Public APIs are free to use; private APIs always require a paid license **Hint:** Think about who can access the API. ### 27. What is webhook security? - Verifying the authenticity of incoming callbacks using signatures - A method for preventing webhooks from timing out during execution - The practice of encrypting the URL of the webhook receiver endpoint - A rule that limits the number of webhooks a single server can receive **Hint:** Think about server callbacks to external systems. ### 28. What are GraphQL-specific security concerns? - Risks involving recursive queries, introspection, and field permissions - Issues related to buffer overflows and hardware-level memory leaks - Vulnerabilities in the underlying TCP/IP stack used for data transfer - A lack of support for modern encryption standards like TLS 1.3 **Hint:** Think about query complexity and introspection. ### 29. What is the importance of logging and monitoring API security? - Detecting patterns of abuse, failed logins, and unauthorized access - Storing user passwords in a plain text file for easy administrative recovery - Recording every successful user request to improve the API search rankings - Automatically blocking any user who accesses the API from a new location **Hint:** Think about detecting attacks and anomalies. ### 30. What is API documentation and security? - Clearly explaining security requirements without leaking internal details - A public list of all user passwords and their corresponding account IDs - Strictly forbidding the use of any external tools to test API endpoints - The practice of hiding the API documentation to prevent hackers from finding it **Hint:** Think about balancing usability with security.