Both of these features can be implemented at the API gateway level, rather than on the individual microservices. This includes following API authentication best practices to make it much harder for attackers to impersonate a valid user by discovering their username and password. For content that should be restricted to logged in users, a reliable, secure authentication method is essential. Whether you’ve inherited an existing API gateway or you’re conducting a security audit of your existing setup, one of the first items on your list should be to ensure all communications between the API gateway and clients are sent over HTTPS, even if authentication is not required. While this simplifies access to the application for clients, it also provides a central platform for implementing security best practices, applying them consistently to all your APIs. Securing an Existing API GatewayĪn API gateway decouples the backend microservices from the public interface of your application, providing a central access point for your APIs. Denial of service and distributed denial of service attacks can be used to take an application offline by hitting it with more requests than it can handle and consuming all its resources. By including invalid content in an API request, malicious code can be injected directly into a system SQL injection and cross-site scripting are the best known forms of this attack. Brute force attacks can be used to discover login credentials, giving attackers access to a user’s account and a platform from which to seek out more vulnerabilities.

In looking for a way in, attackers will make use of all features of an API, even the undocumented ones security by obscurity is not a realistic defense measure.īy definition, APIs provide programmatic access to your application, making them a large attack vector for malicious actors. If the connection from clients to your API gateway isn’t encrypted, all messages you send and receive are out in the open for all to read. Without appropriate authentication and authorization in place, your application can be accessed by anyone who cares to look. As with all content accessed over the internet, APIs and API gateways are vulnerable to myriad threats if not properly secured.

Api gateway waf