Securing non authenticated REST API

Question

I have been reading about securing REST APIs and have read about oAuth and JWTs. Both are really great approaches, but from what I have understood, they both work after a user is authenticated or in other words "logged in". That is based on user credentials oAuth and JWTs are generated and once the oAuth token or JWT is obtained the user can perform all actions it is authorized for.

But my question is, what about the login and sign up apis? How does one secure them? If somebody reads my javascript files to see my ajax calls, they can easily find out the end points and the parameters passed, and they could hit it multiple times through some REST Client, more severely they could code a program that hits my sign up api say a thousand times, which would be create a thousand spam users, or they could even brute force the login api. So how does one secures them?

I am writing my API in yii2.

Answer 1

The Yii 2.0 framework has a buil-in filter called yii\filters\RateLimiter that implements a rate limiting algorithm based on the leaky bucket algorithm. It will allow you to limit the maximum number of accepted requests in a certain interval of time. As example you may limit both login and signup endpoints to accept at most 100 API calls within a 10 minutes interval of time. When that limit is exceeded a yii\web\TooManyRequestsHttpException exception (429 status code) will be thrown.

You can read more about it in the Yii2 RESTful API related documentation or within this SO post.

I didn't use it myself so far but from what I did read about it in official docs, and I mean this:

Note that RateLimiter requires $user to implement the yii\filters\RateLimitInterface. RateLimiter will do nothing if $user is not set or does not implement yii\filters\RateLimitInterface.

I guess it was designed to work with logged in users only maybe by using the user related database table, the default one introduced within the advanced template. I'm not sure about it but I know it needs to store the number of allowed requests and the related timestamp to some persistent storage within the saveAllowance method that you'll need to define in the user class. So I think you will have to track your guest users by IP addresses as @LajosArpad did suggest then maybe redesigning your user class to hold their identities so you can enable it.

A quick google search let me to this extension:yii2-ip-ratelimiter to which you may also have a look.