Slide 22 · MIT 04
Apply identical security controls to all active versions — no exceptions for “deprecated” ones.
A deprecated version that still answers is a version that still needs to be secured. Every active version gets every security control.
The principle
Every API version that responds to requests — regardless of deprecation status — is part of the attack surface. Security controls must be applied to all active versions, not just the current one. This includes: authentication requirements, rate limiting, input validation, security patches, WAF rules, logging, and monitoring.
🔐
Authentication: enforce on all versions
If v2 requires authentication, v1 must also require authentication — or be blocked at the network layer (MIT 03). There is no security value in an auth requirement on v2 if v1 remains accessible without auth. The attack goes through v1.
🚧
Security patches: apply to all versions simultaneously
When a vulnerability is patched, the patch must be applied to every active version at the same time. Patching v2 while leaving v1 unpatched creates a permanent public exploit entry point at v1. If patching an old version is not feasible (codebase too diverged), that version must be blocked immediately at the network layer.
📊
Monitoring: alert on all versions equally
Security monitoring rules that alert on anomalous access patterns must cover all active API versions. An attack through v1 that generates no alerts — because monitoring only covers v2 — goes undetected. Monitoring scope must match the inventory scope.
Practical shortcut: centralize security at the gateway
Rather than applying authentication, rate limiting, and WAF rules per-version in the application code, apply them at the API gateway for all routes matching /api/. The gateway enforces auth regardless of which version is in the path — /api/v1/, /api/v2/, /api/v3/ all require a valid token. This makes it impossible for a new old-version discovery to bypass gateway-level controls.
💼 Business takeaway
Ask your team: if a security vulnerability is patched in your current API version, does that patch also go to older versions that are still running? If not, the older version is a permanent, unpatched exploit entry point.