I have one Spring boot Web application which has few apis facing internet, deployed on aws, they work on JWT token, they're fairly secure. But there are few apis that work on static token validation. They are used for asynchronous operation such as sending emails from lambda etc. These type of apis seems to be somewhat vulnerable, if token gets leaked somehow. What else can be applied as security measures on these type of apis? Token rotation is one way but it has become tedious because there are multiple services that need this type of operation and tokens are stored at multiple places. I'm thinking one additional layer of ip whitelisting that we receive in x-forwarded-for http request. But I tried to overwrite it from Postman and x-forwarded-for header became a comma seperated list ['ip_that_i_put_in_header', 'my_machines_public_ip']. So I guess this can be overwritten. I think it is useless. Even if I do IP whitelisting,how to get CIDR from aws that should be whitelisted? Anything else that I can do?

  • welcome - as i understand it, you can limit access to the api from your own environ, viz. aws.amazon.com/blogs/compute/… (but this would eliminate any public access) if these endpoints must be pub-facing, have you considered signing each individual api-gateway request? have a look at docs.aws.amazon.com/general/latest/gr/signature-version-4.html (the advantage here is you don't place the secret in the request as a static token, but your system component still needs access to the signing secret so it can produce the token)
    – brynk
    Jul 11 at 20:53
  • @brynk the problem with 2nd approach is that if someone has access key and token they can use that to hit the api. Also when I'm changing aws secret access and token, I need to change all the lambda clients to the new aws secret and secret token.
    – akib
    Jul 23 at 23:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.