Apisecure, 14 & 15 March 2023 - Jean Burellier, Principal Software Engineer at Allianz Trade.
summary
Argues that an OpenAPI as source of truth lets teams generate TypeScript types and runtime validators so contracts are enforced everywhere, using tools like AJV/Joi for validation and TypeScript/Joi codegen to stop bad inputs before they hit business logic. Recommends TLS and token auth, warns a newly exposed site gets probed in under ten minutes, and describes wiring the spec into AWS API Gateway enforcement to block invalid requests upstream so malformed or malicious payloads never reach the database.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 8:57API security principles
- 19:09API-first methodology
- 32:38Automating security with contracts
- 44:19Q&A
- 51:00Monitoring authorization challenges
related talks
17mAPI Security Simplified: Practical Tips & Tools
24mAPI Security in DevSecOps: Built-In, Not Bolted On
48mAPI Security for Enterprises fireside chat
01h 29mPrivate Sector API Codesign PART III Panel discussion
23mAI-Driven API Security: Expert Strategies Unveiled
27mAddressing OWASP API Security Top 10 starts at design time
33mWhy Developers Struggle with API Security
55mAPI Security Assurance via E2E Testing