Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [api-gateway]

The tag has no usage guidance.

3
votes
1answer
1k views

How to use Oauth2 and JWT to secure microservice architecture?

We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application. Fundamentally we need stateless security mechanism like ...
5
votes
2answers
3k views

Would a reverse-proxy authentication server be a secure setup?

I work at a small consultancy and we often make web apps for our clients. One part of the web app that is often repetitive to write is the authentication system. In a lot of our web apps we would ...
0
votes
1answer
978 views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
2
votes
1answer
628 views

What's the difference between an API gateway and XML gateway?

I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway". The training material I have states: API gateways are also an important part of a ...
1
vote
0answers
22 views

Concerns when passing all OPTIONS requests through authorization proxy gateway

I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
3
votes
1answer
2k views

OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?

We are currently implementing a Single Page Application (Angular2) and thus have run into the standard "how do we secure our backend API" problem. The standard solution to this apparently to use the ...
3
votes
1answer
1k views

What security controls should be in the API Gateway and what in the webservices?

Nowadays webservices are used a lot and a "new" kind of product is in the streets: the API Gateway. This solucion is published to Internet, receives the requests for webservices from external parties ...