Advanced API Security: Oauth 2.0 and Beyond

ISBN-13: 9781484220498 / Angielski / Miękka / 2019 / 449 str.

Prabath Siriwardena

Opis

This book will prepare you to meet the next wave of challenges in enterprise security, guiding you through and sharing best practices for designing APIs for rock-solid security. It will explore different security standards and protocols, helping you choose the right option for your needs. Advanced API Security, Second Edition explains in depth how to secure APIs from traditional HTTP Basic Authentication to OAuth 2.0 and the standards built around it. Keep your business thriving while keeping enemies away. Build APIs with rock-solid security. The book takes you through the best practices in designing APIs for rock-solid security, provides an in depth understanding of most widely adopted security standards for API security and teaches you how to compare and contrast different security standards/protocols to find out what suits your business needs, the best.
This new edition enhances all the topics discussed in its predecessor with the latest up to date information, and provides more focus on beginners to REST, JSON, Microservices and API security. Additionally, it covers how to secure APIs for the Internet of Things (IoT).
Audience:
The Advanced API Security 2nd Edition is for Enterprise Security Architects and Developers who are designing, building and managing APIs. The book will provide guidelines, best practices in designing APIs and threat mitigation techniques for Enterprise Security Architects while developers would be able to gain hands-on experience by developing API clients against Facebook, Twitter, Salesforce and many other cloud service providers.
What you'll learn
- Build APIs with rock-solid security by understanding best practices and design guidelines.- Compare and contrast different security standards/protocols to find out what suits your business needs, the best.- Expand business APIs to partners and outsiders with Identity Federation.- Get hands-on experience in developing clients against Facebook, Twitter, and Salesforce APIs.- Understand and learn how to secure Internet of Things.

Spis treści

1. APIs Rule!

2. Designing Security for APIs

3. Securing APIs with Transport Layer Security (TLS)

4. OAuth 2.0 Fundamentals

5. Edge Security with an API Gateway

6. OpenID Connect (OIDC)

7. Message Level Security with JSON Web Signature

8. Message Level Security with JSON Web Encryption

9. OAuth 2.0 Profiles

10. Accessing APIs via Native Mobile Apps

11. OAuth 2.0 Token Binding

12. Federating Access to APIs

13. User Managed Access

14. OAuth 2.0 Security

15. Patterns and Practices

16: A. The Evolution of Identity Delegation

17: B. OAuth 1.0

18: C. How Transport Layer Security Works

19: D. UMA Evolution

20. E. Base64URL Encoding

21: F. Basic/Digest Authentication

22: G. OAuth 2.0 MAC Token Profile

O autorze

Prabath Siriwardena is an identity evangelist, author, blogger, and VP of Identity Management and Security at WSO2. He has more than 11 years of industry experience in designing and building critical identity and access management (IAM) infrastructure for global enterprises, including many Fortune 100/500 companies. As a technology evangelist, Prabath has published five books. He blogs on various topics from blockchain, PSD2, GDPR, and IAM to microservices security. He also runs a YouTube channel. Prabath has spoken at many conferences, including RSAConference, Identiverse, European Identity Conference, Consumer Identity World USA, API World, API Strategy and Practice Con, QCon, OSCON, and WSO2Con. He has traveled the world conducting workshops and meetups to evangelize IAM communities. He is the founder of the Silicon Valley IAM User Group, which is the largest IAM meetup in the San Francisco Bay Area.

Blurb

Prepare for the next wave of challenges in enterprise security. Learn to better protect, monitor, and manage your public and private APIs. 

Enterprise APIs have become the common way of exposing business functions to the outside world. Exposing functionality is convenient, but of course comes with a risk of exploitation. This book teaches you about TLS Token Binding, User Managed Access (UMA) 2.0, Cross Origin Resource Sharing (CORS), Incremental Authorization, Proof Key for Code Exchange (PKCE), and Token Exchange. Benefit from lessons learned from analyzing multiple attacks that have taken place by exploiting security vulnerabilities in various OAuth 2.0 implementations. Explore root causes, and improve your security practices to mitigate against similar future exploits. 

Security must be an integral part of any development project. This book shares best practices in designing APIs for rock-solid security. API security has evolved since the first edition of this book, and the growth of standards has been exponential. OAuth 2.0 is the most widely adopted framework that is used as the foundation for standards, and this book shows you how to apply OAuth 2.0 to your own situation in order to secure and protect your enterprise APIs from exploitation and attack. 

You will:

• Securely design, develop, and deploy enterprise APIs
• Pick security standards and protocols to match business needs
• Mitigate security exploits by understanding the OAuth 2.0 threat landscape
• Federate identities to expand business APIs beyond the corporate firewall
• Protect microservices at the edge by securing their APIs
• Develop native mobile applications to access APIs securely
• Integrate applications with SaaS APIs protected with OAuth 2.0