tag: api
API
Securing individual APIs: tokens, gateways, authorization checks and the common ways APIs get abused.
Articles
- Events & community
Planning API Security Training for a Distributed Team
A practical curriculum for teaching API security to developers spread across offices and countries: modules, hands-on labs, formats and how to measure if it worked.
- Events & community
API Security Today: The OWASP API Top 10 in Practice
A talk-style tour of the OWASP API Security Top 10 (2023): broken object level authorization, authentication flaws, resource limits, and fixes that work.
- Events & community
The API Economy in the Nordics: Banking, Public Data, Identity
How the Nordic countries became API-heavy: PSD2 open banking, public sector data APIs, bank-issued digital IDs, and what API teams there focus on for security.
- Events & community
Identity for Telecom and Broadband Cloud Services
How telecom operators and broadband providers use identity: subscriber sign-in, network APIs such as number verification, federation with partners and privacy rules.
- Authorization
OAuth 1.0a vs OAuth 2.0: What Still Matters Today
OAuth 1.0a signed every request; OAuth 2.0 relies on TLS and bearer tokens. How the two differ, where 1.0a survives and how to call a 1.0a API correctly.
- Authorization
Implementing Modern OAuth Techniques: PAR, DPoP and More
The OAuth 2.0 extensions worth adopting now: PKCE everywhere, pushed authorization requests, DPoP, issuer identification, resource indicators and token exchange.
- Cloud computing
Calling On-Premises Web Services From the Cloud, Securely
How cloud apps can call web services that still live in your data center: gateways, mTLS, token exchange and why you should not just open a firewall port.
Guides
- Topic guide
OAuth security: what to get right
A practical OAuth 2.0 security guide based on RFC 9700: choose the right flow, use PKCE and state, validate redirects, limit tokens, protect refresh tokens and APIs.
- Platform category
API gateways
What an API gateway does for security: token validation, rate limits, schema checks, mTLS and routing; how it differs from an authorization server.