Questions tagged [api-gateway]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
2 answers
117 views

Decorating headers after JWT authentication

I'm toying with the idea of terminating JWT after gateway ingress, and looking to see what sort of attack patterns would result. Prerequisites: Communication between services would use mTLS to ...
dardo's user avatar
  • 101
0 votes
0 answers
111 views

Authorizing Access using AD with an API Gateway

We are developing a system that comprises of Component A: Client Application Component B: Gateway API Component C: Backend Web API providing functionality (will be a set of microservices C1, C2 etc) ...
PeeGee's user avatar
  • 1
1 vote
0 answers
90 views

OAuth2/Cognito: Let trusted server act on behalf of user

I'm building a public HTTP JSON API using API Gateway with ID token authentication. I now need a server that acts on behalf of users. Users message that server using a third party (think Signal or ...
Max's user avatar
  • 11
1 vote
0 answers
97 views

Migrate OAuth 2.0 to OAuth 2.1

I have a old Spring Cloud gateway working with Keyclock server. I don't have Web UI for login because the project is a Rest API. OAuth 2.0 is used with Grant type password. I want to migrate to OAuth ...
Peter Penzov's user avatar
0 votes
1 answer
303 views

Should resource servers behind an API gateway independently verify authentication claims?

Is it considered OK to "authenticate" via unverifiable plain-string headers simply asserting a principal name (User-ID: 12345), as long as this is behind an API gateway that does verify ...
Joshua Honig's user avatar
2 votes
0 answers
169 views

Where should rate limit be applied?

I would like to hear the best recommendations about where to apply rate limit on APIs. We use k8s (microservices) with an ingress controller that is behind an API gateway, that is behind a firewall. ...
Felipe Emerim's user avatar
0 votes
1 answer
578 views

Does "validating" a JWT token from prove authentication with OpenId?

I have a static react app which users login via an Okta SPA app. The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request. ...
NSjonas's user avatar
  • 143
0 votes
0 answers
93 views

How can I secure an API used for app secret keys without using CORS, created using AWS API gateway?

I am using an API , made using an AWS service named API Gateway [Which may not be of great importance]. I have gone through various articles mentioning that rather than storing secret keys directly on ...
Jidnyesh AJ's user avatar
0 votes
2 answers
2k views

Is there any additional overhead over using Oauth vs Client Certificates?

I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
tjax03's user avatar
  • 103
0 votes
0 answers
117 views

How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?

Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
Daniel Arechiga's user avatar
0 votes
2 answers
152 views

How can API documentation helpful to exploit any application?

Here I want to understand what if private API Documentation is exposed how can a hacker exploited the application as all the endpoints have authorization & authentication. its is really going to ...
Nitin Rastogi's user avatar
1 vote
0 answers
92 views

Generate new AccessToken each time user update his Information

im building a PWA app , where i implemented jwt token to auth users. i have 2 main architecture problems ,but let me introduce you what im building . i'm Building application that is all about dog ...
Natanel Soussana's user avatar
1 vote
1 answer
867 views

May I use OAuth2 for non third-party applications?

I need some help to understand my problem. I'm studying a way to provide authentication for my applications. My scenario: I have a set of APIs with restricted access and users that will be ...
Simio's user avatar
  • 11
3 votes
1 answer
2k views

Can we prevent DDoS or spam form submission with client authentication?

There is a public query form in my web app, and architecture team asking to authenticate the web app with OAuth2 like this, but I don't believe it will be of any help. I believe best way to protect ...
smali's user avatar
  • 153
1 vote
0 answers
96 views

Integrating web applications into our payment API. How to ensure the integrity of the payment process?

We will be creating a brand new application soon that handles online payments for our firm. We now have several different web applications (in different technologies) running that will all be ...
Steven Lemmens's user avatar
1 vote
0 answers
297 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
Mornon's user avatar
  • 131
0 votes
2 answers
217 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
Mornon's user avatar
  • 131
6 votes
4 answers
265 views

Security considerations of consuming public API

I have a website and i want to consume public API from third party services such as Zoopla, weather etc. I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
Architect 's user avatar
4 votes
1 answer
5k views

How to use Oauth2 and JWT to secure microservice architecture?

We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application. Fundamentally we need stateless security mechanism like ...
Nuwan Attanayake's user avatar
14 votes
2 answers
12k views

Would a reverse-proxy authentication server be a secure setup?

I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
illabout's user avatar
  • 243
3 votes
1 answer
10k views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
john's user avatar
  • 149
3 votes
2 answers
6k views

What's the difference between an API gateway and XML gateway?

I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway". The training material I have states: API gateways are also an important part of a ...
Mike B's user avatar
  • 3,458
2 votes
0 answers
81 views

Concerns when passing all OPTIONS requests through authorization proxy gateway

I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
Kunok's user avatar
  • 121
3 votes
1 answer
3k views

OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?

We are currently implementing a Single Page Application (Angular2) and thus have run into the standard "how do we secure our backend API" problem. The standard solution to this apparently to use the ...
donmartin's user avatar
  • 166
3 votes
1 answer
2k views

What security controls should be in the API Gateway and what in the webservices?

Nowadays webservices are used a lot and a "new" kind of product is in the streets: the API Gateway. This solucion is published to Internet, receives the requests for webservices from external parties ...
Eloy Roldán Paredes's user avatar