NSE5-FWB-AD-8-0: Fortinet NSE 5 - FortiWeb 8.0 Administrator

By Fortinet · Question Mode

QuestionQ38

VerifiedWeb application and API security with botnet mitigation

A FortiWeb administrator observes the following request:

GET /api/v1/data HTTP/1.1 -  
  
Host: example.com -  
Authorization: ApiKey abc123def456

The API key belongs to a user in group B, who is permitted to access only /api/v1/reports.

What should the administrator do to prevent this unauthorized access?

Explanation

FortiWeb API gateway rules can verify API keys and restrict access by allowed API user group, including for particular sub-URLs. Configuring /api/v1/data to permit only its authorized group prevents a group B API key from accessing that endpoint while preserving the group's permitted access to /api/v1/reports.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!