Issue 268: Cloudflare disables HTTP, Moodle and Flowise API flaws, DevSecOps & API secure design
Brief
This week, we focus on secure API design and best practices. We examine Cloudflare’s latest measures to prevent API token exposure, analyze three recent API vulnerabilities affecting an AI platform, a WordPress plugin, and a popular LMS solution, and highlight key articles on DevSecOps and API security best practices.
Article: How HTTPS redirects can expose API data
In a March blog post , Cloudflare announced it will block all API requests made over unsecured HTTP at the network level, ensuring that all client connections use encrypted HTTPS.
Some API servers enforce HTTPS by redirecting HTTP requests to secure endpoints, this method still exposes sensitive data such as API keys or access tokens to potential man-in-the-middle attacks during the initial unencrypted request.