Be IT Conference 2015 | Skrill - How to protect your REST APIs with OAuth
•Transferir como PPTX, PDF•
0 gostou•563 visualizações
The document discusses different approaches to protecting REST APIs with OAuth, including adding validation in every service, using an API gateway to decouple validation, and using ApiFest which is an open source API gateway that supports OAuth out of the box. It also discusses ways to take protection further such as adding information to tokens, reformatting communication, and unifying multiple services.
Recomendados
Recomendados
Mais conteúdo relacionado
Semelhante a Be IT Conference 2015 | Skrill - How to protect your REST APIs with OAuth
Semelhante a Be IT Conference 2015 | Skrill - How to protect your REST APIs with OAuth (20)
Mais de Polina Dekova
Mais de Polina Dekova (12)
Último
Último (20)
Be IT Conference 2015 | Skrill - How to protect your REST APIs with OAuth
- 1. Page 1 How to protect your REST APIs with OAuth 15 May 2015
- 2. Page 2 • Introduction • OAuth in a nutshell • Approaches • API Gateway • ApiFest • Taking things further • Q & A Agenda
- 3. Page 3 Hi, I’m Ivan Introduction
- 5. Page 5 Simple OAuth Flow
- 6. Page 6 • Adding validation in every service Approaches
- 8. Page 8 • Filtering requests before service code is executed Smarter Aproach
- 9. Page 9 Token Validation Flow
- 10. Page 10 • Entirely decoupling validation The Different Approach
- 11. Page 11 • Decouple the validation from the rest of the application API Gateway
- 12. Page 12 API Gateway Web Service Flow
- 13. Page 13 ApiFest • Open source (Apache 2 Licenced): http://apifest.com/ https://github.com/apifest • Authored by Rossitsa Borissova
- 14. Page 14 ApiFest • Built-in support for OAuth2 • Uses Netty • Built-in clustering support via Hazelcast • Can remap requests • Mapping configuration via xml • Allows plugging in your own code • Online reloading
- 15. Page 15 • Adding information to the token Taking things further
- 16. Page 16 Web Service Flow
- 17. Page 17 • Adding information to the token • Reformatting the communication Taking things further
- 18. Page 18 Web Service Flow
- 19. Page 19 • Adding information to the token • Reformatting the communication • Unifying multiple services Taking things further
- 20. Page 20 Web Service Flow
- 21. Page 21 Q & A
- 23. Page 23 Skrill Ltd | Level 27 | 25 Canada Square | London E14 5LQ | UK www.skrill.com Skrill Ltd | Level 27 | 25 Canada Square | London E14 5LQ | UK www.skrill.com
Notas do Editor
- Викане на ресурсите без да има код свързан с оторизацията в ресурса
- В момента няма вградена подръжка за OAuth2, но може да се направи лесно. Сториджа(Пърсистънса) може лесно да бъде подменен с друг Конфигурацията може да се генерира директно от кода
- Ограничаване на достъпа - по IP според разрешени в токъна мрежи