Secure by Default: Encrypted APIs, Allowed Origins, Two-Step Sign-In

Intro

0:00 Security which ships with the server : encrypted requests and answers, encrypted strings, allowed origins, two-step sign in, and the known vulnerabilities of every package. In this video, the security features of API Maker, on Calm Home.

Security, the usual way

0:18 Security usually means a ticket for each item : encryption, CORS, two-step sign in, audits, each one built by hand, differently in every service, and the ones which never get done. With API Maker, they are settings and headers, ready on every server, the same for every API of every table, and a report says what is left to fix. In this video : encrypted requests and answers, Encrypt Strings, allowed origins, two-step sign in, and vulnerabilities, with their report.

Encrypted requests and answers

0:50 Payments come from the browser of the shop. The Collection Settings of sales.payments say acceptOnlyEncryptedData. And the app encrypts each body with the transfer key of the default secret, and the time it was made. The key is shared with the app, never written in its code. A payment sent in clear : refused, this API supports only encrypted payloads. The app encrypts the payment. Sent with x-am-encrypted-payload : saved, two hundred and one.

1:22 The same payment, encrypted ten minutes ago : payload expired. A request caught on the way can not be sent again later. An answer can be encrypted too : with x-am-get-encrypted-data, data is null and encryptedData holds it. The app reads it with the same key : order three, delivered.

Encrypt Strings

1:43 Security, Encrypt Strings. A connection string, a fake one here. Encrypt : the text to put in the env file instead, so a terminal or a screen share shows no password. Copy. It hides the string, it does not protect it : every copy of API Maker can read it back.

Allowed origins

2:03 Operations, Sandbox Settings, Allowed Origins. Add New : the web shop, https://shop.calmhome.example. Save : the settings of the sandboxes are saved with it. A browser call from another site : four hundred and three, blocked before anything runs. From the shop : two hundred. From a server, with no Origin header : two hundred too. It is a rule for browsers.

Two-step sign in

2:30 Two-step sign in : the menu of the account, My Security. The policy is set by the root user, and shown here read only : email codes, an authenticator app, recovery codes. Set up : scan the square with an authenticator app, type its code, and the account is linked ; its recovery codes are shown once. Here we close : nothing is linked.

Vulnerabilities

2:53 Security, Vulnerabilities : two audits. The packages of the sandboxes, in eight languages. And the hundreds of crates API Maker itself is built from. Each advisory with its score, and what can be done. Download the audit : a report ready to print or to save as a PDF, with what to do first.

Good to know

3:15 Signing in to the panel asks for a captcha, and too many wrong passwords stop the sign in for a few minutes. The panel talks to the server through an encrypted channel, and its pages carry security headers. Encrypted and hashed fields protect data at rest : video four. And while this video was made, the audit found four advisories in rustls : API Maker moved to the version which fixes them.

Built on standards

3:42 Security as settings, not as tickets. The same rules for every API of every table. So code written by an AI assistant can not skip them : they run before it does.

Recap

3:54 To sum up. Encrypted requests, and encrypted answers. Strings encrypted for the env file. Allowed origins. Two-step sign in. And vulnerabilities, with a report. Next : automatic caching. API Maker. Build faster, spend smarter, deliver better.