Reconciling Zero-Trust APIs and Developer eXperience
summary
Claims a practical way to reconcile zero‑trust APIs with developer experience by shifting security left via a containerized OIDC mock provider that developers run locally or in CI. Implementation uses Quarkus + Swagger UI, issues JWTs signed with a private key, supports audience/issuer checks, role and object‑level authorization, and predefined test cases. Demo shows 401 then success after adding a token and a 403 for unauthorized roles, and the mock reuses the same keys so integration and component tests validate the real token logic.
AI-written summary · about
chapters (10)
- 0:00Zero-trust APIs and DX
- 1:58Speakers
- 3:08Moving to cloud and microservices
- 5:07OpenID Connect in microservices
- 7:18Testing secured APIs
- 10:32Mock OpenID providers
- 11:45Security testing demo with Quarkus
- 18:28Key takeaways and OSS contributions
- 19:13Shifting left security
- 20:39Conclusion and resources
related talks
46mSecure your Microservices with ZeroTrust approach
45mZero Trusting as a True Cloud Native Dev
26mZero Trust Security for your APIs
31mSecure your Quarkus Applications
33mSecuring Your Quarkus Applications
38mZero Trust Security for your APIs
52mIntroduction to Quarkus Security
35mQuarkus Security for Spring developers