Protecting API Workloads Against OWASP and Programming Language CVE's
summary
Deploys a small demo stack via Terraform: three microservices on GCP behind NGINX Plus as an edge API gateway, integrated with Okta (OpenID Connect) to issue JWTs. JWT audience and scope enforce role-based access (admin vs user), rate limits derive from token subject to throttle per-customer, and a dynamic module NGINX App Protect blocks XSS, SQLi and command-injection payloads. Logs include support IDs and export to ELK/Splunk; the Terraform repo reproduces the working demo.
AI-written summary · about
chapters (9)
- 0:00Start
- 7:44Architecture
- 16:51Structure of Nha Token
- 30:04Nginx App Protect
- 31:01What To Protect
- 33:40Configuration
- 35:02Api Security Policies
- 44:26Is the Attack Signature Detected in both Request and Query String and Payload
- 45:01How Is the Support Id Generated and Tracked
related talks
49mProtecting API workloads OWASP Top 10
43mSecuring Apps in the Open-By-Default Cloud
55mSecure your APIs the Well-Architected way from foundation to perimeter
57mBulletproof Microservices with Spring and Kubernetes
45mAPI Security: Acting Now to Enable Security Controls
36mAdvanced Authentication patterns at the Edge
34mZero trust CI/CD pipeline
52mOpen-Source to the Rescue of My APIs: Securing Them with Gravitee.io and Keycloak