Topics of Interest: Attacking the microservice systems: methods and practical tips
summary
A concise checklist and concrete findings help decide: a fragile npm JWT library at version 0.1.1 with no signature verification infects seven microservices; a JHipster management endpoint leaks a private GitHub token; tenant isolation implemented from an untrusted Host header leads to cross‑tenant access until fixed by using tenant id inside a signed JWT; use of RESTler and Yelp stateful API fuzzers plus semgrep and asset discovery scripts drives the assessments.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:15Motivation
- 4:35Architecture
- 7:17Architecture Assessment
- 11:01What features to analyze
- 11:54What you should check
- 16:22Thirdparty JS library issue
- 18:37GitHub access token leakage
- 20:21Authorization features
- 27:32Microservice Security Design Assessment Checklist
- 28:12Takeaways
related talks
01h 02mPractical Microservice Security
49mPractical Microservice Security
57mHow Do I Secure My Micro-Services?
53mSecurity And Microservices
01h 06mMicroservice Authentication and Authorization
01h 02mInsecure Transit - Microservice Security
28mHow to Protect Java Microservices and React.js Micro frontends
51mAppSec and Microservices