Web Application API Discovery & Protection with FortiWeb

Abstract

Modern-day web applications rely heavily on APIs, creating an expanded attack surface that demands some specialized security measures. In this paper, we examine FortiWeb, which is a web application firewall (WAF) from Fortinet that addresses API discovery and protection in enterprise environments. The architecture of FortiWeb combines traditional WAF defenses with machine learning-driven API discovery and schema-based protection to safeguard APIs against both known and unknown threats [8], [10], [11]. The key capabilities include the automatic detection of undocumented API endpoints, enforcement of Open API/JSON/XML schema definitions, and runtime policy controls, which together form a positive security model [11], [14]. This solution provides real-time visibility into API traffic and threats, thus allowing security teams to identify the shadow APIs and enforce granular policies without excessive manual configuration [9],[24]. We will also discuss the API attack surface in modern web applications. FortiWeb’s architectural approach to API security, the mechanisms for API discovery and protection, and the operational considerations. The use case scenarios illustrate FortiWeb in action, and we will outline limitations and practical constraints. This study highlights the integration of FortiWeb’s API discovery and protection capabilities that can significantly enhance the security of web application APIs while aligning with DevSecOps practices.