Military-Grade Security for APIs
summary
FAPI 2 pushes concrete controls: use mTLS with CNF claim so the authorization server stores a certificate hash in the access token and APIs verify certificate binding, or use DPoP / RFC 9449 when mTLS is unavailable; protect the authorization request with PAR (RFC 9126) to stop tampering, and protect the response with JARM (signed JWT responses) to prevent mix‑up attacks. FAPI 2 is short, prescriptive, and focused on token protection and client authentication.
AI-written summary · about
chapters (8)
- 0:00Military-grade API security intro
- 2:14FAPI as secure API foundation
- 5:23Mutual TLS and token binding
- 8:54Certificate-bound tokens
- 11:24PAR protection
- 15:00JARM for auth responses
- 18:31Mix-up attacks prevention
- 19:57Key takeaways and next steps
related talks
24mAPI Security in Open Banking Context
18mAPI Security Simplified: A 5-Pillar Approach
18mSecure your Apps and APIs with strong authentication and Adaptive Access.
39mAPI = Authentication’s Poorly Implemented
17mAPI Security Simplified: Practical Tips & Tools
12mSweet or Heat
07mthe critical role of API protection
29mDefence in depth