API Security 2025完全ガイド - OWASP API Top 10の実践的対策

# authorization.py
from functools import wraps
from fastapi import HTTPException, Depends, status
from typing import Callable

def check_resource_ownership(resource_type: str):
    def decorator(func: Callable) -> Callable:
        @wraps(func)
        async def wrapper(*args, **kwargs):
            # 現在のユーザーを取得
            current_user = kwargs.get('current_user')
            resource_id = kwargs.get('resource_id')
            
            # リソースを取得
            Model = globals()[resource_type.capitalize()]
            resource = await Model.get(resource_id)
            
            if not resource:
                raise HTTPException(
                    status_code=status.HTTP_404_NOT_FOUND,
                    detail="Resource not found"
                )
            
            # 所有権の確認
            if resource.user_id != current_user.id and not current_user.is_admin:
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail="Access denied"
                )
            
            kwargs['resource'] = resource
            return await func(*args, **kwargs)
        
        return wrapper
    return decorator

# 使用例
@app.get("/orders/{order_id}")
@check_resource_ownership("order")
async def get_order(
    order_id: str,
    current_user: User = Depends(get_current_user),
    resource: Order = None
):
    return resource

// middleware/authorization.go
func CheckResourceOwnership(resourceType string) gin.HandlerFunc {
    return func(c *gin.Context) {
        userID := c.GetString("userID")
        resourceID := c.Param("id")
        
        var ownerID string
        
        switch resourceType {
        case "order":
            var order models.Order
            if err := db.First(&order, resourceID).Error; err != nil {
                c.JSON(404, gin.H{"error": "Resource not found"})
                c.Abort()
                return
            }
            ownerID = order.UserID
            c.Set("resource", order)
            
        case "profile":
            var profile models.Profile
            if err := db.First(&profile, resourceID).Error; err != nil {
                c.JSON(404, gin.H{"error": "Resource not found"})
                c.Abort()
                return
            }
            ownerID = profile.UserID
            c.Set("resource", profile)
        }
        
        // 所有権の確認
        if ownerID != userID && !isAdmin(userID) {
            c.JSON(403, gin.H{"error": "Access denied"})
            c.Abort()
            return
        }
        
        c.Next()
    }
}

// 使用例
router.GET("/orders/:id", 
    AuthMiddleware(),
    CheckResourceOwnership("order"),
    handlers.GetOrder,
)

// WebAuthn/Passkeys実装
const { 
  generateRegistrationOptions,
  verifyRegistrationResponse,
  generateAuthenticationOptions,
  verifyAuthenticationResponse
} = require('@simplewebauthn/server');

// WebAuthn登録開始
app.post('/api/webauthn/register/start', authenticate, async (req, res) => {
  const user = await User.findById(req.user.id);
  
  // 既存の認証器を取得
  const existingAuthenticators = user.authenticators || [];
  
  const options = await generateRegistrationOptions({
    rpName: 'MyApp',
    rpID: 'example.com',
    userID: user.id,
    userName: user.email,
    userDisplayName: user.name,
    attestationType: 'none',
    excludeCredentials: existingAuthenticators.map(auth => ({
      id: auth.credentialID,
      type: 'public-key',
      transports: auth.transports,
    })),
    authenticatorSelection: {
      authenticatorAttachment: 'platform',
      requireResidentKey: true,
      residentKey: 'preferred',
      userVerification: 'preferred'
    },
  });
  
  // チャレンジを保存
  await User.updateOne(
    { _id: user.id },
    { 
      currentChallenge: options.challenge,
      challengeExpiry: new Date(Date.now() + 5 * 60 * 1000)
    }
  );
  
  res.json(options);
});

// WebAuthn登録完了
app.post('/api/webauthn/register/finish', authenticate, async (req, res) => {
  const user = await User.findById(req.user.id);
  const { credential } = req.body;
  
  if (!user.currentChallenge || new Date() > user.challengeExpiry) {
    return res.status(400).json({ error: 'Challenge expired' });
  }
  
  try {
    const verification = await verifyRegistrationResponse({
      response: credential,
      expectedChallenge: user.currentChallenge,
      expectedOrigin: 'https://example.com',
      expectedRPID: 'example.com',
      requireUserVerification: true,
    });
    
    if (!verification.verified) {
      return res.status(400).json({ error: 'Verification failed' });
    }
    
    const { credentialPublicKey, credentialID, counter } = 
      verification.registrationInfo;
    
    // 認証器を保存
    await User.updateOne(
      { _id: user.id },
      {
        $push: {
          authenticators: {
            credentialID: Buffer.from(credentialID),
            credentialPublicKey: Buffer.from(credentialPublicKey),
            counter,
            transports: credential.response.transports,
            createdAt: new Date()
          }
        },
        $unset: { currentChallenge: 1, challengeExpiry: 1 }
      }
    );
    
    res.json({ verified: true });
  } catch (error) {
    console.error(error);
    res.status(400).json({ error: 'Registration failed' });
  }
});

// WebAuthn認証
app.post('/api/webauthn/login/start', async (req, res) => {
  const { email } = req.body;
  const user = await User.findOne({ email });
  
  if (!user || !user.authenticators?.length) {
    // ユーザーが存在しないことを隠す
    return res.json({
      challenge: crypto.randomBytes(32).toString('base64'),
      allowCredentials: []
    });
  }
  
  const options = await generateAuthenticationOptions({
    allowCredentials: user.authenticators.map(auth => ({
      id: auth.credentialID,
      type: 'public-key',
      transports: auth.transports,
    })),
    userVerification: 'preferred',
  });
  
  // チャレンジを保存
  await LoginSession.create({
    userId: user.id,
    challenge: options.challenge,
    expiry: new Date(Date.now() + 5 * 60 * 1000)
  });
  
  res.json(options);
});

// SMS/Email OTP実装
const twilio = require('twilio');
const nodemailer = require('nodemailer');

const twilioClient = twilio(
  process.env.TWILIO_ACCOUNT_SID,
  process.env.TWILIO_AUTH_TOKEN
);

// OTP送信
app.post('/api/otp/send', authenticate, async (req, res) => {
  const { method, destination } = req.body;
  
  // レート制限
  const key = `otp:${req.user.id}:${method}`;
  const attempts = await redis.incr(key);
  
  if (attempts === 1) {
    await redis.expire(key, 300); // 5分で3回まで
  } else if (attempts > 3) {
    return res.status(429).json({ 
      error: 'Too many attempts. Try again later.' 
    });
  }
  
  // 6桁のOTPを生成
  const otp = crypto.randomInt(100000, 999999).toString();
  
  // OTPをRedisに保存（5分間有効）
  await redis.setex(
    `otp:${req.user.id}:${otp}`,
    300,
    JSON.stringify({ method, destination, attempts: 0 })
  );
  
  try {
    if (method === 'sms') {
      await twilioClient.messages.create({
        body: `Your verification code is: ${otp}`,
        to: destination,
        from: process.env.TWILIO_PHONE_NUMBER
      });
    } else if (method === 'email') {
      const transporter = nodemailer.createTransport({
        host: process.env.SMTP_HOST,
        port: 587,
        secure: false,
        auth: {
          user: process.env.SMTP_USER,
          pass: process.env.SMTP_PASS
        }
      });
      
      await transporter.sendMail({
        from: '"MyApp" <noreply@example.com>',
        to: destination,
        subject: 'Your verification code',
        html: `
          <p>Your verification code is:</p>
          <h2>${otp}</h2>
          <p>This code will expire in 5 minutes.</p>
        `
      });
    }
    
    res.json({ 
      message: 'OTP sent successfully',
      expiresIn: 300
    });
  } catch (error) {
    console.error('OTP send error:', error);
    res.status(500).json({ error: 'Failed to send OTP' });
  }
});

// OTP検証
app.post('/api/otp/verify', authenticate, async (req, res) => {
  const { otp } = req.body;
  
  const key = `otp:${req.user.id}:${otp}`;
  const data = await redis.get(key);
  
  if (!data) {
    return res.status(400).json({ error: 'Invalid or expired OTP' });
  }
  
  const otpData = JSON.parse(data);
  
  // 試行回数をチェック
  if (otpData.attempts >= 3) {
    await redis.del(key);
    return res.status(400).json({ error: 'Too many failed attempts' });
  }
  
  // OTPを削除（一度だけ使用可能）
  await redis.del(key);
  
  // セッションを更新またはトークンを発行
  const tokens = generateTokens(req.user);
  res.json({
    message: 'OTP verified successfully',
    ...tokens
  });
});

// 高度なレート制限（スライディングウィンドウ、コスト基準）
class AdvancedRateLimiter {
  constructor(redis) {
    this.redis = redis;
  }
  
  // コストベースのレート制限
  async checkCostBasedLimit(key, cost, options = {}) {
    const {
      maxCost = 1000,
      windowMs = 60000,
      refillRate = 100 // 毎秒回復するコスト
    } = options;
    
    const now = Date.now();
    const windowStart = now - windowMs;
    
    // Lua スクリプトでアトミックに処理
    const luaScript = `
      local key = KEYS[1]
      local now = tonumber(ARGV[1])
      local cost = tonumber(ARGV[2])
      local maxCost = tonumber(ARGV[3])
      local windowMs = tonumber(ARGV[4])
      local refillRate = tonumber(ARGV[5])
      
      -- 現在のコストを取得
      local currentCost = tonumber(redis.call('get', key) or 0)
      local lastRefill = tonumber(redis.call('get', key .. ':lastRefill') or now)
      
      -- コストを回復
      local timePassed = (now - lastRefill) / 1000
      local refilled = math.min(currentCost, timePassed * refillRate)
      currentCost = math.max(0, currentCost - refilled)
      
      -- 新しいコストをチェック
      if currentCost + cost > maxCost then
        return {0, currentCost, maxCost}
      end
      
      -- コストを追加
      currentCost = currentCost + cost
      redis.call('set', key, currentCost)
      redis.call('set', key .. ':lastRefill', now)
      redis.call('expire', key, windowMs / 1000)
      redis.call('expire', key .. ':lastRefill', windowMs / 1000)
      
      return {1, currentCost, maxCost}
    `;
    
    const result = await this.redis.eval(
      luaScript,
      1,
      key,
      now,
      cost,
      maxCost,
      windowMs,
      refillRate
    );
    
    return {
      allowed: result[0] === 1,
      currentCost: result[1],
      maxCost: result[2],
      remainingCost: Math.max(0, result[2] - result[1])
    };
  }
  
  // スライディングウィンドウ
  async checkSlidingWindow(key, options = {}) {
    const {
      windowMs = 60000,
      max = 60
    } = options;
    
    const now = Date.now();
    const windowStart = now - windowMs;
    
    const pipe = this.redis.pipeline();
    
    // 古いエントリを削除
    pipe.zremrangebyscore(key, '-inf', windowStart);
    
    // 現在のカウントを取得
    pipe.zcard(key);
    
    // 新しいエントリを追加（まだ制限内の場合）
    pipe.zadd(key, now, `${now}-${Math.random()}`);
    
    // TTLを設定
    pipe.expire(key, Math.ceil(windowMs / 1000));
    
    const results = await pipe.exec();
    const count = results[1][1];
    
    if (count >= max) {
      // 制限を超えた場合、追加したエントリを削除
      await this.redis.zrem(key, `${now}-${Math.random()}`);
      return {
        allowed: false,
        count: count,
        max: max,
        resetAt: windowStart + windowMs
      };
    }
    
    return {
      allowed: true,
      count: count + 1,
      max: max,
      resetAt: windowStart + windowMs
    };
  }
}

// 使用例
const limiter = new AdvancedRateLimiter(redis);

// APIコストミドルウェア
const costBasedLimiter = (costMap) => {
  return async (req, res, next) => {
    const endpoint = `${req.method}:${req.route.path}`;
    const cost = costMap[endpoint] || 1;
    const key = req.user ? `cost:user:${req.user.id}` : `cost:ip:${req.ip}`;
    
    const result = await limiter.checkCostBasedLimit(key, cost, {
      maxCost: req.user?.subscription === 'premium' ? 5000 : 1000,
      windowMs: 3600000, // 1時間
      refillRate: req.user?.subscription === 'premium' ? 200 : 50
    });
    
    // ヘッダーに情報を追加
    res.set({
      'X-RateLimit-Cost': cost,
      'X-RateLimit-Remaining': result.remainingCost,
      'X-RateLimit-Limit': result.maxCost
    });
    
    if (!result.allowed) {
      return res.status(429).json({
        error: 'Rate limit exceeded',
        retryAfter: Math.ceil(cost / (result.maxCost / 3600))
      });
    }
    
    next();
  };
};

// エンドポイントごとのコスト定義
const apiCosts = {
  'GET:/api/users': 1,
  'GET:/api/users/:id': 1,
  'POST:/api/users': 10,
  'GET:/api/reports/generate': 100,
  'POST:/api/ai/generate': 50
};

app.use('/api', costBasedLimiter(apiCosts));

// 分散環境対応（複数インスタンス、地理的分散）
const Redlock = require('redlock');

class DistributedRateLimiter {
  constructor(redisNodes) {
    this.clients = redisNodes.map(node => new Redis(node));
    this.redlock = new Redlock(this.clients, {
      retryCount: 3,
      retryDelay: 200
    });
  }
  
  // グローバル分散レート制限
  async checkGlobalLimit(key, options = {}) {
    const {
      max = 1000,
      windowMs = 60000,
      shardCount = this.clients.length
    } = options;
    
    // 各シャードの制限を計算
    const maxPerShard = Math.ceil(max / shardCount);
    
    // ローカルシャードをチェック
    const localShard = this.getShardForKey(key);
    const localResult = await this.checkLocalLimit(
      localShard, 
      key, 
      maxPerShard, 
      windowMs
    );
    
    if (!localResult.allowed) {
      // ローカルで拒否された場合、他のシャードをチェック
      return this.checkOtherShards(key, max, windowMs);
    }
    
    return localResult;
  }
  
  // シャード間でのレート制限チェック
  async checkOtherShards(key, max, windowMs) {
    const results = await Promise.all(
      this.clients.map(client => 
        this.getShardCount(client, key, windowMs)
      )
    );
    
    const totalCount = results.reduce((sum, count) => sum + count, 0);
    
    return {
      allowed: totalCount < max,
      count: totalCount,
      max: max,
      distributed: true
    };
  }
  
  // 地理的に分散したレート制限
  async checkGeoDistributedLimit(key, options = {}) {
    const {
      regions = ['us-east', 'eu-west', 'ap-south'],
      maxPerRegion = 1000,
      maxGlobal = 2500,
      windowMs = 60000
    } = options;
    
    // 現在のリージョンを特定
    const currentRegion = this.getCurrentRegion();
    
    // ローカルリージョンのチェック
    const localKey = `${key}:${currentRegion}`;
    const localResult = await this.checkLocalLimit(
      this.getRegionalClient(currentRegion),
      localKey,
      maxPerRegion,
      windowMs
    );
    
    if (!localResult.allowed) {
      return { ...localResult, region: currentRegion };
    }
    
    // グローバル制限のチェック（非同期）
    this.checkGlobalLimitAsync(key, maxGlobal, windowMs);
    
    return {
      ...localResult,
      region: currentRegion,
      globalCheckPending: true
    };
  }
  
  // バースト対応のトークンバケット
  async checkTokenBucket(key, options = {}) {
    const {
      capacity = 100,
      refillRate = 10, // トークン/秒
      tokensRequested = 1
    } = options;
    
    const luaScript = `
      local key = KEYS[1]
      local capacity = tonumber(ARGV[1])
      local refillRate = tonumber(ARGV[2])
      local tokensRequested = tonumber(ARGV[3])
      local now = tonumber(ARGV[4])
      
      -- 現在のトークン数と最終更新時刻を取得
      local bucket = redis.call('hmget', key, 'tokens', 'lastRefill')
      local tokens = tonumber(bucket[1] or capacity)
      local lastRefill = tonumber(bucket[2] or now)
      
      -- トークンを補充
      local timePassed = math.max(0, now - lastRefill)
      local tokensToAdd = math.floor(timePassed * refillRate / 1000)
      tokens = math.min(capacity, tokens + tokensToAdd)
      
      -- トークンをチェック
      if tokens < tokensRequested then
        -- トークン不足
        local waitTime = math.ceil((tokensRequested - tokens) * 1000 / refillRate)
        return {0, tokens, waitTime}
      end
      
      -- トークンを消費
      tokens = tokens - tokensRequested
      redis.call('hmset', key, 'tokens', tokens, 'lastRefill', now)
      redis.call('expire', key, 3600)
      
      return {1, tokens, 0}
    `;
    
    const result = await this.clients[0].eval(
      luaScript,
      1,
      key,
      capacity,
      refillRate,
      tokensRequested,
      Date.now()
    );
    
    return {
      allowed: result[0] === 1,
      remainingTokens: result[1],
      waitTimeMs: result[2],
      capacity: capacity
    };
  }
}

// 使用例
const distributedLimiter = new DistributedRateLimiter([
  { host: 'redis1.example.com', port: 6379 },
  { host: 'redis2.example.com', port: 6379 },
  { host: 'redis3.example.com', port: 6379 }
]);

// ミドルウェア
app.use(async (req, res, next) => {
  const key = req.user ? `user:${req.user.id}` : `ip:${req.ip}`;
  
  // バーストトラフィックに対応
  const result = await distributedLimiter.checkTokenBucket(key, {
    capacity: 100,      // バースト時の最大
    refillRate: 10,     // 通常時は10req/秒
    tokensRequested: 1
  });
  
  res.set({
    'X-RateLimit-Remaining': result.remainingTokens,
    'X-RateLimit-Capacity': result.capacity
  });
  
  if (!result.allowed) {
    return res.status(429).json({
      error: 'Rate limit exceeded',
      retryAfter: Math.ceil(result.waitTimeMs / 1000)
    });
  }
  
  next();
});