Avaliação de estratégias de mitigação contra CSRF e XSS em APIs RESTful: implementação, testes e análise comparativa de desempenho e segurança

Abstract

This study experimentally evaluates the effectiveness of various mitigation strategies against Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) attacks in RESTful APIs. A JWT-authenticated API was developed, followed by the progressive implementation of security mechanisms: anti-CSRF tokens, SameSite cookies, HTTP Origin/Referer header validation, Content Security Policy (CSP), and input sanitization. Controlled testing using Burp Suite and automated load tools measured performance metrics such as average response time and CPU consumption. Results demonstrate that combining strategies is significantly more effective at preventing CSRF than any single technique. Additionally, the combination of CSP and input sanitization effectively neutralizes XSS payloads with minimal performance impact. A complementary evaluation of processing time showed that applying CSRF and XSS protections simultaneously caused only a negligible increase in response latency, without compromising legitimate request handling. The research provides experimental data and practical recommendations for hardening web API security