The API must authenticate remote commands.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-274723 | SRG-APP-000461-API-001075 | SV-274723r1143761_rule | CCI-003747 | medium |
| Description | ||||
| Authentication safeguards for remote commands help to ensure that information systems accept and execute, in the order intended, only authorized commands and reject unauthorized commands. Cryptographic mechanisms can be employed, for example, to authenticate remote commands. Safeguards include, at a minimum, FIPS-compliant cryptographic hash. Standard API authentication protocols provide this protection (e.g., Oauth 2.0, JWT). | ||||
| STIG | Date | |||
| Application Programming Interface (API) Security Requirements Guide | 2025-09-24 | |||
Details
Check Text (C-274723r1143761_chk)
Verify the API authenticates remote commands.
If the API does not authenticate remote commands, this is a finding.
Fix Text (F-78729r1142980_fix)
Build or configure the API to authenticate remote commands.