42crunch/gitlab-api-security-audit repository overview

⁠GitLab Pipeline Job: 42Crunch REST API Static Security Testing

The REST API Static Security Testing job lets you add an automatic static application security testing (SAST) task to your CI/CD pipelines. The pipe checks your OpenAPI files for their quality and security from a simple Git push to your project repository when the CI/CD pipeline runs.

The job is powered by 42Crunch API Security Audit⁠. Security Audit performs a static analysis of the API definition that includes more than 200 checks on best practices and potential vulnerabilities on how the API defines authentication, authorization, transport, and data coming in and going out. For more details on the checks, see API Security Encyclopedia⁠.

As a result of the security testing, your APIs get an audit score, with 100 points meaning the most secure, best defined API. By default, the threshold score for the job to pass is 75 points for each audited API, but you can change the minimum score in the job configuration.

API contracts must follow the OpenAPI Specification (OAS) (formely Swagger). Both OAS v2 and v3, and both JSON and YAML formats are supported.

You can create a free 42Crunch account at https://platform.42crunch.com/register⁠, and then configure the job.

⁠Discover APIs

By default, the job locates all OpenAPI files in your project and submits them for static security testing. You can include or exclude specific paths from the discovery phase and can omit the discovery phase completely by adding a configuration file 42c-conf.yaml in the root of your repository and specifying rules for the discovery phase. For more details, see the documentation⁠.

All discovered APIs are uploaded to an API collection in 42Crunch Platform. The job uses the build variables CI_PROJECT_URL and CI_COMMIT_REF_NAME to show the repository and the branch name from where the API collection originated from. During the subsequent job runs, the APIs in the collection are kept in sync with the changes in your repository.

⁠Fine-tune the job

You can add a configuration file 42c-conf.yaml in the root of your repository, and to fine-tune the success/failure criteria. For example, you can choose on whether to accept invalid API contracts, or define a cut-off on a certain level of issue severity.

You can define different configuration for different branches in your repository. You can use the full name of the branch (for example, master) or a wildcard (for example, release-*) when designating which branch the configuration applies to.

For more details, see the documentation⁠.

⁠YAML Definition

Add the following snippet to the relevant section of your .gitlab-ci.yml file:

image:
  name: 42crunch/gitlab-api-security-audit:v2
variables:
script: /audit/audit.sh

⁠Variables

(*) = required variable.

⁠Prerequisites

Create an API token in 42Crunch Platform and copy its value into a protected and masked project variable named X42C_API_TOKEN.

For more details, see the full documentation⁠.

⁠Examples

Basic example (of the of entire pipeline with a single job):

audit:
  stage: test
  image:
    name: 42crunch/gitlab-api-security-audit:v2
  script: /audit/audit.sh

Advanced example (of the of entire pipeline with a single job):

audit:
  stage: test
  image:
    name: 42crunch/gitlab-api-security-audit:v2
  variables:
    X42C_PLATFORM_URL: https://platform.42crunch.com/
    X42C_MIN_SCORE: 85
    X42C_LOG_LEVEL: DEBUG
  script: /audit/audit.sh

⁠Support

The job is maintained by [email protected]⁠. If you run into an issue, or have a question not answered here, you can create a support ticket at support.42crunch.com⁠.

If you’re reporting an issue, do include:

• The version of the pipe
• Relevant logs and error messages
• Steps to reproduce the issue