Skip to content

Security features

Security features

  • Tokens and groups decide who can call which API, table and field. The features below add more layers on top of them.

Encrypted request payloads

  • Send the header x-am-encrypted-payload: true and put the encrypted payload in dataEncFE.
  • dataEncFE is { data, createdAt } encrypted with encryptionAlgorithmFETransfer and secretFETransfer of the secret. Share that key with your frontend or mobile app.
  • A payload older than feTransferDataValidityInSeconds is refused, so a captured request can not be replayed later.
  • Turn on acceptOnlyEncryptedData and plain bodies and query strings are refused. It can be set for a database, a table, an API, and for custom, system and third party APIs.
1
2
3
4
5
POST /api/schema/admin/bank/main/transfers/save-single-or-multiple
x-am-authorization: <API user token>
x-am-encrypted-payload: true

{ "dataEncFE": "U2FsdGVkX1+q3n..." }

1
2
3
4
5
common: <T.ISecretTypeCommon>{
    encryptionAlgorithmFETransfer: 'AES',
    secretFETransfer: '...',
    feTransferDataValidityInSeconds: 300, // older payloads are refused
},

Encrypted responses

  • Send the header x-am-get-encrypted-data to get the response encrypted in encryptedData, with the same transfer key.
Value Response
no_encryption data only
get_only_encryption encryptedData only, data is null
get_data_and_encryption data and encryptedData

Allowed origins

  • Add the web origins of your apps in Allowed Origins on the Sandbox Settings page.
  • When the list has entries, a browser request from any other origin is refused with 403 before anything runs.
  • An empty list allows every origin.

Two-factor sign-in

  • The root user can ask for a second factor when people sign in to the admin panel: a code from an authenticator app, a code sent by email, or both.
  • Recovery codes are shown once and stored hashed.
  • The root user also sets the code length and expiry, the attempts and the resend delay.
  • Email codes need the SMTP settings of the root user settings.

Vulnerabilities

  • The Vulnerabilities page audits the packages of API Maker and the npm packages of your sandboxes for known vulnerabilities.

Encrypted and hashed fields

  • Schema conversions can store a field encrypted or as an HMAC SHA-256 hash, with the keys of your secret.

Good to know

  • API Maker itself speaks plain HTTP. Run it behind Caddy or another proxy that serves HTTPS: the installer sets up Caddy.
  • Encrypted payloads do not replace HTTPS. They add a layer on top of it, useful when TLS ends before API Maker.