What would you like?
This demo is designed to showcase a system my co-founder and I designed to restrict API endpoint
communication to only approved company-issued clients with great success. I also introduced it to my
fellow engineers while I was an Engineering Manager in my previous NewYork Fintech position and it
cut their sales lead submission fraud down significantly.
While no system is perfect, security is often a balance of level of difficulty and time investment for the bad actor to payoff of a successful bypass.
I encourage any frontend engineers attempt a bypass of this system via various debugging/code inspection tools and contact me with a level of difficulty 0-10 for a reward.
While no system is perfect, security is often a balance of level of difficulty and time investment for the bad actor to payoff of a successful bypass.
I encourage any frontend engineers attempt a bypass of this system via various debugging/code inspection tools and contact me with a level of difficulty 0-10 for a reward.
Key Highlights
- Single-use generated ephemeral keys for each API call, with replay attack protection.
- Client-side API key is derived during runtime to make source code inspection difficult.
- Various code protections and defense/counter inspection techniques have been applied to drastically increase the complexity and difficult to reverse-engineer the API key.
- Even if successfully reverse engineered by a competent actor, the ability to train non-technical users to apply the techniques themselves is significantly reduced.
- Even if successfully reserve engineered, all API calls must be made via a custom script or application that can perform hash calculations for each request.
- Client side API keys can be rolled on a regular basis, requiring any previous bypass to reverse engineer the system again or write a tool to automate the reverse-engineering process.