API Security in Action

API Security in Action teaches you how to create secure APIs for any situation. By following this handson guide youll build a social network API while mastering techniques for flexible multiuser security, cloud key management, and lightweight cryptography.SummaryA web API is an efficient way to communicate with an application or service. However, this convenience opens your systems to new security risks. API Security in Action gives you the skills to build strong, safe APIs you can confidently expose to the world. Inside, youll learn to construct secure and scalable REST APIs, deliver machinetomachine interaction in a microservices architecture, and provide protection in resourceconstrained IoT (Internet of Things) environments.Purchase of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning Publications.About the technologyAPIs control data sharing in every service, server, data store, and web client. Modern datacentric designsincluding microservices and cloudnative applicationsdemand a comprehensive, multilayered approach to security for both private and publicfacing APIs.About the bookAPI Security in Action teaches you how to create secure APIs for any situation. By following this handson guide youll build a social network API while mastering techniques for flexible multiuser security, cloud key management, and lightweight cryptography. When youre done, youll be able to create APIs that stand up to complex threat models and hostile environments.Whats insideAuthenticationAuthorizationAudit loggingRate limitingEncryptionAbout the readerFor developers with experience building RESTful APIs. Examples are in Java.About the authorNeil Madden has indepth knowledge of applied cryptography, application security, and current API security technologies. He holds a Ph.D. in Computer Science.Table of ContentsPART 1 FOUNDATIONS1 What is API security?2 Secure API development3 Securing the Natter APIPART 2 TOKENBASED AUTHENTICATION4 Session cookie authentication5 Modern tokenbased authentication6 Selfcontained tokens and JWTsPART 3 AUTHORIZATION7 OAuth2 and OpenID Connect8 Identitybased access control9 Capabilitybased security and macaroonsPART 4 MICROSERVICE APIs IN KUBERNETES10 Microservice APIs in Kubernetes11 Securing servicetoservice APIsPART 5 APIs FOR THE INTERNET OF THINGS12 Securing IoT communications13 Securing IoT APIs