Architecting API Security

Is your perimeter security obsolete? Learn the architectural patterns that contain attackers who are already inside your network and prevent lateral movement.

#1about 2 minutes

The urgent need for API security from day one

Recent studies show widespread vulnerabilities like hard-coded keys and authorization failures, highlighting the necessity of designing for security from the start.

#2about 1 minute

Focusing on secure architecture over just code

The OWASP API Security Top 10 reveals that many critical risks, like broken authorization, are best addressed through architectural design rather than just secure coding practices.

#3about 2 minutes

A typical API architecture overview

A common API architecture consists of clients, an API gateway acting as a single entry point, and various backend APIs or microservices handling specific responsibilities.

#4about 6 minutes

Why perimeter security is no longer enough

A compromised internal service, such as a vulnerable image processor, can breach the entire trusted zone, demonstrating that a single perimeter defense is insufficient.

#5about 5 minutes

Using compartmentalization for defense-in-depth

By isolating high-risk services like image processors into separate trust zones, you can contain the damage from a potential breach as part of a defense-in-depth strategy.

#6about 3 minutes

Isolating both untrusted and sensitive services

Compartmentalization applies both to sandboxing untrusted components and to creating secure enclaves for highly sensitive services like authentication or payments.

#7about 5 minutes

Authenticating internal API-to-API calls

To prevent a compromised internal service from moving laterally, enforce authentication between all internal APIs and define strict policies on which services can communicate.

#8about 5 minutes

Propagating user context to internal APIs

Internal services need user context to make authorization decisions, which can be achieved by forwarding the user's authentication state from the gateway via a token relay.

#9about 4 minutes

Using reference tokens instead of raw JWTs

To avoid exposing large or sensitive JWTs to clients, an API gateway can issue a small, opaque reference token and translate it back to the full JWT for internal API calls.

#10about 2 minutes

Following JWT security best practices

JSON Web Tokens are not a complete security solution and require careful implementation to avoid common pitfalls related to signature validation, algorithm choice, and revocation.

#11about 2 minutes

Key architectural takeaways for API security

Improve your API security by planning for compromise, choosing simple and robust solutions, and using the API gateway to shield internal implementation details from clients.