What are best practices for securing nested APIs?
Here is an example:
User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet)
Typically, REST API A is protected using something like OAuth tokens. However, the question is since API A is calling API B, should it be an App to App security model between them and not use user context or use the user context i.e. the user token is passed from A to B for additional Authentication & Authorization in addition to using some other mechanism to ensure that B is called only from A?
Having two levels of AuthN & AuthZ between A & B may sound redundant and additional processing but wouldn't it provide the most security?