API9:2023 — Improper Inventory Management

Slide 21 · MIT 03

Restrict old versions at the network layer — before removing them from the codebase.

Make old versions unreachable from the internet while they still run internally. Network control before code deletion.

Why network-layer restriction matters

Removing an API version from the codebase is a development project. It takes time, requires testing, and may be blocked by dependencies. Network-layer restriction (gateway routing rules, WAF rules, firewall rules) can be applied immediately, making the old version unreachable from the internet even while it still runs on the server.

Without network restriction

v1 is “deprecated” in the docs

v1 still answers requests from the internet

Attacker discovers it via path fuzzing

Codebase removal is “planned for next quarter”

Attack surface remains until dev completes removal

With network restriction

Sunset date reached: gateway blocks /api/v1/

v1 still runs internally (no rush to remove it)

Internet requests return 404 or 410 (Gone)

Codebase removal happens when dev team is ready

Attack surface closed immediately; removal is cleanup

Implementation: API gateway routing rules

At the API gateway (Nginx, Kong, AWS API Gateway, Azure APIM), add a routing rule that returns HTTP 410 Gone for all requests to old version paths (/api/v1/, /v1/, /legacy/). This is a one-line change at the gateway level and takes effect immediately across the entire infrastructure without touching application code. For subdomains (staging-api.): DNS removal or firewall egress block prevents external resolution.

💼 Business takeaway

Ask your team whether old API versions can be blocked at the network or gateway level before the codebase cleanup is finished. Removing access is faster than removing code, and it eliminates the attack surface immediately.

← Back MIT 04: Same security for all versions →