My WebAPI is, just that, an API backend for my UI to consume. In fact, I will have perhaps 10's of WebAPI services that my UI will use.
I'm having difficulty understanding what I need to consider in terms of security.
My APIs are secured using Bearer tokens, and allow https only. I have CORS set up and they only allow the origin https://my-front.end This all works great.
However.. how can I protect against C/XSRF and replay attacks on a WebAPI? Do I even need to?
Setting up anti-CSRF is rather painless with an ASP.NET MVC project, but how can you do it on a WebAPI one, from what I understand it relies on sending information, generated on the server, to the client to send along in the body of the request and through another channel (e.g. cookie or header). I read that you can protect against replay attacks by using a nonce (e.g. timestamp and random number) -- some how -- but can't find any implementation examples.
Is there anything else I need to consider?
Edit: front end uses vue.js, but we have a very competent JS programmer so any front-end implementations won't be a problem. It's just a matter of finding out what needs to be done!
May also be worth noting, for sake of obviousness, WebAPIs and FrontEnd run on different servers, so these are all, effectively, cross origin calls.