Protecting API workloads OWASP Top 10
summary
Deploys NGINX Ingress Controller + App Protect on GKE via Terraform to gate microservices, integrates Okta OIDC JWT validation (public JWKs cached, signature and expiry checked) and enforces claim-based scopes for fine-grain RBAC. Demonstrates runtime WAF rules that block XSS, SQLi and file reads, HTTP header/query validation, and rate limit 10 requests/min per IP (throttling/burst configurable). Live demo shows policies reject malicious requests at the gateway so upstream services never see them.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:25Data Breaches
- 5:00API Security
- 15:50Group Security
- 19:50Rate Limiting
- 23:50How to apply Rate Limiting
- 24:50HTTP Protocol Validation
- 28:00Late Response
- 29:05Crosssite scripting
- 35:35Clubhouse
- 40:35Final Words
- 44:15Questions
related talks
54mProtecting API Workloads Against OWASP and Programming Language CVE's
39mHow to Reconcile Security and Agility for the Good of Your Applications
36mAdvanced Authentication patterns at the Edge
55mSecure your APIs the Well-Architected way from foundation to perimeter
43mSecuring Apps in the Open-By-Default Cloud
33mHow to implement DDoS protection in GCP
16mConnecting and securing workloads from anywhere made easy with AI/ML
01h 04mProtect Your Applications with Azure WAF and Application Gateway