Defence in depth
summary
Concrete checklist for securing REST APIs: draw a map of all clients, users, audiences and scopes including forgotten machine-to-machine integrations; implement a six-step API pipeline per service that 1) rejects malformed HTTP, 2) verifies JWT signature issuer audience type and exp, 3) transforms claims to local permissions, 4) checks operation-level permissions early (403), 5) validates input (400), and 6) enforces per-resource access control. Use well‑known libraries, keep tokens minimal, store detailed rights locally, and cover the pipeline with unit tests.
AI-written summary · about
chapters (5)
- 0:00Start
- 13:59start with validating the incoming request
- 15:28use secure hardened frameworks
- 17:08transforming the information in the token
- 27:07start with a short meeting
related talks
08mAPI Security Risks
25m10 steps to secure your API
47mImplement defence in depth for your Java API:s
17mAPI Security Simplified: Practical Tips & Tools
53mCommon API Security Pitfalls
37mCommon REST API security pitfalls
50mCommon API security pitfalls
25mAPI Security Deep Dive: Safeguard Your Digital Assets