Microservice Security at the API Level
summary
Argues that API security must become transactional authorization across microservices and shows a working pattern: normalize identity and attributes at the front door, externalize policies to distributed decision points at the service edge, and push enforcement into proxies and sidecars (examples: Envoy/Kong/istio sidecars). Claims this yields sub-millisecond latency, avoids central backhauls, supports extreme scale like one million+ TPS, and produces high‑resolution logs and policy visualizations that map tokens, consent and entitlements.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:42Digital Innovation
- 2:26The Past
- 3:11Hard Requirements
- 6:51Identity Authorization
- 8:35Rethinking Identity Authorization
- 9:35Open Banking Open Data
- 10:32Innovation Factor
- 12:18Avoiding Backhaul
- 18:01Identity Providers
- 19:04Active Directory
- 20:44Faster Innovation
- 21:33Questions Answers
related talks
32mSecuring Value in API Ecosystems
26mBuilding Scalable Microservice APIs From The Beginning
01h 06mMicroservice Authentication and Authorization
38mTop 10 Security Best Practices to secure your Microservices
57mHow Do I Secure My Micro-Services?
49mPractical Microservice Security
41mSecurity Patterns for Microservice Architectures
23mAuthentication and Authorization in Micro Services