Questions tagged [api-gateway]
The api-gateway tag has no usage guidance.
16
questions
1
vote
0answers
31 views
Generate new AccessToken each time user update his Information
im building a PWA app , where i implemented jwt token to auth users.
i have 2 main architecture problems ,but let me introduce you what im building .
i'm Building application that is all about dog ...
-1
votes
0answers
64 views
Application layer DDOS attack detection - enough to analyse only GET/POST requests?
I am developing a DOS attack recognition module for application layer requests.
The application has a backend consisting several APIs. They all are connected through an API gateway(developed in Node ...
0
votes
1answer
51 views
May I use OAuth2 for non third-party applications?
I need some help to understand my problem.
I'm studying a way to provide authentication for my applications.
My scenario:
I've a set of APIs with restricted access and users that will be ...
2
votes
1answer
171 views
Can we prevent DDoS or spam form submission with client authentication?
There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don't believe it will be of any help.
I believe best way to protect ...
1
vote
0answers
43 views
Integrating web applications into our payment API. How to ensure the integrity of the payment process?
We will be creating a brand new application soon that handles online payments for our firm. We now have several different web applications (in different technologies) running that will all be ...
1
vote
0answers
70 views
Security aspect in the API gateway area
I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level.
Scanning REST APIs
(see http://docs.w3af....
0
votes
0answers
19 views
Secure API and User Data both with Oauth2.0
We are currently looking at adding API endpoints for a third party to consume and the endpoints will be concerning individual user data.
The current proposed security architecture is to use Oauth2.0 ...
0
votes
2answers
129 views
Rest API Security Guideline. Developer Rules? [closed]
In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
5
votes
4answers
115 views
Security considerations of consuming public API
I have a website and i want to consume public API from third party services such as Zoopla, weather etc.
I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
4
votes
1answer
4k views
How to use Oauth2 and JWT to secure microservice architecture?
We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application.
Fundamentally we need stateless security mechanism like ...
9
votes
2answers
6k views
Would a reverse-proxy authentication server be a secure setup?
I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
0
votes
1answer
3k views
How I can enumerate all endpoints of an API?
Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
2
votes
2answers
2k views
What's the difference between an API gateway and XML gateway?
I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway". The training material I have states:
API gateways are also an important part of a ...
2
votes
0answers
25 views
Concerns when passing all OPTIONS requests through authorization proxy gateway
I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
3
votes
1answer
2k views
OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?
We are currently implementing a Single Page Application (Angular2) and thus have run into the standard "how do we secure our backend API" problem.
The standard solution to this apparently to use the ...
3
votes
1answer
2k views
What security controls should be in the API Gateway and what in the webservices?
Nowadays webservices are used a lot and a "new" kind of product is in the streets: the API Gateway. This solucion is published to Internet, receives the requests for webservices from external parties ...
