Formal Specification and Verification of API Security Based on Design by Contract

The exploitation and hijacking of API vulnerabilities are becoming increasingly prominent issues in software supply chain security. This paper proposes an Object-Z based formal verification method for APIs in the supply chain, aiming to address the security risks associated with API applications. By incorporating the concept of design by contract and using Object-Z for formal modeling, a dynamic defense against API threats is implemented. Finally, based on a classification analysis of API threats in the supply chain, this paper presents a ase study through modeling and application analysis.