Propuesta de un método de mejores prácticas para optimizar el nivel de seguridad en el desarrollo de Servicios Web RESTFul.

Abstract

The main aim of this research was to propose and apply in a given scenario a better practice method for developing WEB RESTFul Services, and it was carried out on the basis of analysis methods and specified existing techniques in REST Security Cheat Sheet from OWASP. Two scenarios were implemented with a RESTFul application on each one implemented with Expressjs and Mongodb as data manager, where it was demonstrated an applied service with the existing methods, Scenario 1, posted on a cloud service called Heroku with the configuration values rendered by the service, Scenario 2, it was applied with the proposed method which has the better practices in the development stage of these services and it was published in a droplet (Virtual Cloud server) digital ocean, where the operating system was configured and the elementary tools in order to release the application, Furthermore a digital certificate configuration along with its own sub dominion. Both applications are published and configured on the web in order to be able to access to these applications by means of a Postman client and the pentesting Vooki tool. Given the stated hypothesis a proposal application for a better practice method will improve the security level in the development of Web RESTFul services, by applying the analysis based on the parameters to be assessed,a 88.89% was obtained according to the optimization in the satisfaction degree and implementing pentesting Vooki tool a 90% optimization was gathered in a number of vulnerabilities detected on authenticity standards and started session. It is concluded that the proposed method to optimize the security level in these services development and it is suggested the appropriate configuration in the framework where this service is going to be used.