A Comprehensive Secure Architecture for Web APIs: A Case Study on Banking Financial Systems

Web APIs have become a fundamental component of modern software systems, enabling communication among web applications, mobile platforms, and distributed backend services. As the adoption of API-driven architectures continues to grow, these interfaces increasingly face security challenges such as unauthorized access, brute-force authentication attempts, token misuse, and exposure of sensitive data. These vulnerabilities demonstrate the necessity of adopting structured and comprehensive security architectures capable of protecting API infrastructures across multiple layers. This study proposes a comprehensive secure architecture for Web APIs that integrates several widely adopted security mechanisms within a unified layered model. The proposed architecture combines transport-layer protection using HTTPS, stateless authentication through JSON Web Tokens (JWT), secure password hashing with BCrypt, role-based access control (RBAC), strict input validation, and request rate limiting. By integrating these mechanisms within a single architectural framework, the proposed approach aims to enhance the resilience of API services against common security threats while maintaining scalability and maintainability. To validate the practicality of the proposed architecture, a banking transaction Web API was implemented as a case study using the ASP.NET Core framework. The implemented system includes secure user authentication, protected account management operations, and financial transaction endpoints that incorporate the proposed security layers. The results indicate that integrating multiple defensive mechanisms within a coherent architectural structure significantly improves the overall security posture of Web APIs without compromising system performance. The proposed model therefore provides a practical guideline for designing secure API infrastructures in sensitive domains such as financial and banking systems.

کلیدواژه ها:

Web API Security ، Banking Systems ، JWT Authentication ، Rate Limiting ، BCrypt Password Hashing ، Secure Software Architecture