[metadata]
id = "API10-C"
type = "recommendation"
category = "API"
number = 10
title = "APIs should have security options enabled by default"
description = """
APIS should have security options enabled by default– for example, having best
practice cipher suites enabled by default (something that changes over time)
while disabling out-of-favor cipher suites by default. When interface stability
is also a design requirement, an interface can meet both goals by providing off-
by-default options that produce stable behavior, such
asTLS_ENABLE_Y2015_BEST_PRACTICE_CIPHERS_ONLY. If the caller of this API in this
noncompliant example doesn't understand what the options mean, they will pass 0
orTLS_DEFAULT_OPTIONSand get a connection vulnerable to man-in-the-middle
attacks and using old versions of TLS. int tls_connect_by_name(const char *host,
int port, int option_bitmask); #define TLS_DEFAULT_OPTIONS 0 #define
TLS_VALIDATE_HOST 0x0001 #define TLS_DISABLE_V1_0 0x0002 #define
TLS_DISABLE_V1_1 0x0004
"""
severity = "Medium"
likelihood = "Likely"
priority = "P6"
level = "L3"
cert_version = "2016 Edition (Wiki)"
last_modified = "May 20, 2025"
[rules.cert_c.API10-C]
enabled = true
[references]
wiki = "https://wiki.sei.cmu.edu/confluence/display/c/API10-C.+APIs+should+have+security+options+enabled+by+default"