To expand on the above answers by @mhr and @Raimonds-Liepiņš:
Validate Data
Meticulously validate all data pulled from the public API. Any text or "unknown" data must be filtered through a Security Encoding Library.
For example consider weather data being pulled from a public API.
- Temperature - An acceptable temperature could be a negative or positive number and at most three digits. If three digits, the first number will always be a
1
. Be specific. Anything different should error out.
- Forecast Summary Text - Basic text using
A-Za-z0-9
and standard punctuation. Define max amount of text allowed and produce an error for anything exceeding that threshold. Alternatively, consider truncating the data and apply ...
suffix denoting this action. This data must be filtered through a Security Encoding Library.
Respect Rate Limits
Ensure your client will not abuse the rate limits placed on the public API. While the public API will likely have it's own method of enforcement, its best to be a good citizen and remain under the threshold.
Use TLS
TLS provides lots of protections as noted below. Require the use of a secure protocol (e.g. TLS 1.2
) and strong cipher. Anything less should error out.
You get all of the benefits of an encrypted connection!
- Assurance knowing you're connected directly to the target website via certificate validation. This protects against: Man-in-the-middle attacks, DNS hijacking, BGP hijacking, Domain spoofing (Why is HTTP not secure?).
- The target website is more secure since all content is loaded over
HTTPS
. Some examples include protecting against posting from http to https and mixed-content while securing logins and cookies.
- Some ISPs have been known to monitor connections for ad serving purposes which encryption defeats.
- You're protected should an adjacent system become compromised.
Source: Does HSTS provide security advantages on private networks?
Check OWASP
Since your post didn't include specifics regarding the framework being used and data consumed, the above is a generalized guideline that expands on the answers already provided. For specifics, take a look at OWASP as well as their Cheat Sheet Series. The main page may require some searching to find what you're looking for but will be well worth it.