Apidays Paris 2023 - Securing Microservice-based APIs, Michal Trojanowski, Curity

Apidays Paris 2023 - Software and APIs for Smart, Sustainable and Sovereign Societies
December 6, 7 & 8, 2023

Securing Microservice-based APIs
Michal Trojanowski, Product Marketing Engineer at Curity

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. Securing Microservice-based APIs Michał Trojanowski Product Marketing Engineer @ Curity @mtrojan@mastodon.social
2. How APIs Grow
3. API Gateway Breadth-grown API Depth-grown APIs
4. API Security Maturity API Keys and Basic Authentication Token-Based Authentication Token-Based Authorization API-Key: abcdef
5. Common Security Problem
6. Breadth-grown APIs Client Undocumented endpoints API Gateway
7. Depth-grown APIs Client API Gateway external service !
8. What are the Options?
9. Change the Optics Access Token What is the caller authorized to do? Who is calling?
10. Breadth-grown APIs scope: read Require scope “write” Client Undocumented endpoints API Gateway scope: read
11. Read past transactions Read future transactions Create transactions Modify transactions Update transactions
12. Read and manage transactions
13. Claims-based Authorization API Gateway sub: user@example.com client_id: mobile-app sub: user@example.com client_id: background-app
14. Token Sharing — Exchanging Tokens
15. Token Sharing — Embedding Tokens
16. - Identity Chaining across Trust Domains (https://datatracker.ietf.org/doc/draft-schwenkschuster-oauth-i dentity-chaining/) - Multi-token Container Data Structure (https://datatracker.ietf.org/doc/draft-richer-wimse-token-cont ainer/) Proposed Standards
17. Entitlement Management Systems
18. Key Takeaways • Merely implementing OAuth and using access tokens might not be a sufficient security measure for large APIs. • Remember that access tokens are not related to user sessions. • Limit the capabilities of a token: • use claims-based authorization • implement proper token sharing techniques
19. Thank You! curity.io developer.curity.io @curityio info@curity.io Come meet us at our booth in Partner Village!