APIセキュリティ - 安全なAPI設計と実装

OWASP API Security Top 10

認証・認可

JWT + リフレッシュトークン

import jwt from 'jsonwebtoken';

const ACCESS_TOKEN_EXPIRY = '15m';
const REFRESH_TOKEN_EXPIRY = '7d';

function generateTokens(userId: string, role: string) {
 const accessToken = jwt.sign(
 { sub: userId, role, type: 'access' },
 process.env.JWT_SECRET!,
 { expiresIn: ACCESS_TOKEN_EXPIRY }
 );

 const refreshToken = jwt.sign(
 { sub: userId, type: 'refresh' },
 process.env.JWT_REFRESH_SECRET!,
 { expiresIn: REFRESH_TOKEN_EXPIRY }
 );

 return { accessToken, refreshToken };
}

// ミドルウェア
function authMiddleware(req: Request, res: Response, next: NextFunction) {
 const token = req.headers.authorization?.replace('Bearer ', '');

 if (!token) {
 return res.status(401).json({ error: 'No token provided' });
 }

 try {
 const payload = jwt.verify(token, process.env.JWT_SECRET!, {
 algorithms: ['HS256'], // アルゴリズム明示指定
 });
 req.user = payload;
 next();
 } catch (error) {
 return res.status(401).json({ error: 'Invalid token' });
 }
}

RBAC（ロールベースアクセス制御）

const permissions = {
 admin: ['read', 'write', 'delete', 'manage_users'],
 editor: ['read', 'write'],
 viewer: ['read'],
};

function requirePermission(...requiredPermissions: string[]) {
 return (req: Request, res: Response, next: NextFunction) => {
 const userRole = req.user?.role;
 const userPermissions = permissions[userRole] || [];

 const hasPermission = requiredPermissions.every(
 p => userPermissions.includes(p)
 );

 if (!hasPermission) {
 return res.status(403).json({ error: 'Insufficient permissions' });
 }

 next();
 };
}

// 使用
app.delete('/users/:id', authMiddleware, requirePermission('delete', 'manage_users'), deleteUser);

入力検証

import { z } from 'zod';

const CreateUserSchema = z.object({
 email: z.string().email().max(255),
 password: z.string().min(8).max(100)
 .regex(/[A-Z]/, 'Must contain uppercase')
 .regex(/[0-9]/, 'Must contain number'),
 name: z.string().min(1).max(100)
 .regex(/^[a-zA-Z\s]+$/, 'Only letters allowed'),
});

function validateBody<T>(schema: z.ZodSchema<T>) {
 return (req: Request, res: Response, next: NextFunction) => {
 const result = schema.safeParse(req.body);

 if (!result.success) {
 return res.status(400).json({
 error: 'Validation failed',
 details: result.error.flatten().fieldErrors,
 });
 }

 req.body = result.data;
 next();
 };
}

app.post('/users', validateBody(CreateUserSchema), createUser);

レート制限

import rateLimit from 'express-rate-limit';
import RedisStore from 'rate-limit-redis';

// 一般的なレート制限
const generalLimiter = rateLimit({
 store: new RedisStore({ client: redisClient }),
 windowMs: 15 * 60 * 1000, // 15分
 max: 100,
 message: { error: 'Too many requests' },
 standardHeaders: true,
});

// 認証エンドポイント用（より厳しい）
const authLimiter = rateLimit({
 store: new RedisStore({ client: redisClient }),
 windowMs: 60 * 60 * 1000, // 1時間
 max: 5, // 5回まで
 message: { error: 'Too many login attempts' },
});

app.use('/api', generalLimiter);
app.use('/api/auth/login', authLimiter);

セキュリティヘッダー

import helmet from 'helmet';

app.use(helmet({
 contentSecurityPolicy: {
 directives: {
 defaultSrc: ["'self'"],
 scriptSrc: ["'self'"],
 styleSrc: ["'self'", "'unsafe-inline'"],
 imgSrc: ["'self'", "data:", "https:"],
 },
 },
 hsts: {
 maxAge: 31536000,
 includeSubDomains: true,
 preload: true,
 },
}));

// CORS設定
app.use(cors({
 origin: ['https://example.com', 'https://app.example.com'],
 methods: ['GET', 'POST', 'PUT', 'DELETE'],
 allowedHeaders: ['Content-Type', 'Authorization'],
 credentials: true,
 maxAge: 86400,
}));

SQLインジェクション対策

// 悪い例
const query = `SELECT * FROM users WHERE id = '${userId}'`;

// 良い例（パラメータ化クエリ）
const [users] = await db.query(
 'SELECT * FROM users WHERE id = ?',
 [userId]
);

// ORMを使用（さらに安全）
const user = await prisma.user.findUnique({
 where: { id: userId },
});

機密データの保護

// レスポンスから機密フィールドを除外
function sanitizeUser(user: User): PublicUser {
 const { password, refreshToken, ...publicData } = user;
 return publicData;
}

// シリアライザパターン
class UserSerializer {
 static toPublic(user: User): PublicUser {
 return {
 id: user.id,
 email: user.email,
 name: user.name,
 createdAt: user.createdAt,
 };
 }

 static toAdmin(user: User): AdminUser {
 return {
 ...this.toPublic(user),
 role: user.role,
 lastLoginAt: user.lastLoginAt,
 };
 }
}

監査ログ

interface AuditLog {
 timestamp: Date;
 userId: string;
 action: string;
 resource: string;
 resourceId: string;
 ip: string;
 userAgent: string;
 success: boolean;
}

async function auditLog(log: AuditLog) {
 await db.auditLogs.create({ data: log });
}

// ミドルウェア
function audit(action: string) {
 return async (req: Request, res: Response, next: NextFunction) => {
 const originalSend = res.send;

 res.send = function(body) {
 auditLog({
 timestamp: new Date(),
 userId: req.user?.id,
 action,
 resource: req.baseUrl,
 resourceId: req.params.id,
 ip: req.ip,
 userAgent: req.headers['user-agent'],
 success: res.statusCode < 400,
 });

 return originalSend.call(this, body);
 };

 next();
 };
}

app.delete('/users/:id', audit('DELETE_USER'), deleteUser);

関連記事

• JWTの仕組み - トークン認証の詳細
• OAuth 2.0 / OIDC - 外部認証連携
• Webセキュリティベストプラクティス - 総合セキュリティ
• レート制限 - API保護の詳細

まとめ

APIセキュリティは、認証・認可、入力検証、レート制限、セキュリティヘッダーを組み合わせて実現します。OWASP API Top 10を参考に、包括的な対策を実装しましょう。

参考リソース

• OWASP API Security Top 10 - 2023
• OWASP Cheat Sheet Series - REST Security
• MDN - HTTP Headers (Security)
• RFC 6749 - The OAuth 2.0 Authorization Framework
• NIST SP 800-63B - Digital Identity Guidelines

×

PR

×

PR