Collaborative Security Annotation and Online Testing for Web APIs
Hsiao-Jung Chen, Shang‐Pin Ma, Hsueh-Cheng Lu · 2021
As API security gains more and more attention, we devised a system, called API Prober 2.0 (AP2 for short), to better support the discovery and management of security-enabled Web APIs. AP2 supports two main features for Web APIs: security schemes annotation and an online testing mechanism. Based on the concept of collaborative development, the users in AP2 can augment the OAS (OpenAPI Specification) documents of Web APIs with appropriate security schemes, semi-automatically extract access tokens, and perform online testing on service endpoints of Web APIs. Besides, we use the AP2 system to actually annotate security schemes and execute tests for nine actual APIs. The evaluation results show that all core features of AP2 were successfully realized. It is verified that the AP2 system is feasible and can effectively help developers use security-enabled Web APIs more efficiently.