Securing different types of Web APIs
summary
WSO2 API Manager uses gateway token introspection to ask the authorization server for claims, then bundles those claims into a signed JWT placed in an HTTP header so backends verify signature trust; partners include ThingAi for anomaly detection and 42Crunch for OpenAPI security audits. Mobile apps use PKCE, prefer httpOnly secure sameSite cookies over localStorage, and choose JWT vs opaque tokens based on scale and revocation needs. GraphQL needs depth, result and batch limits plus cost analysis; apply UUIDs or gateway translation to avoid broken object level authorization.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 5:20Welcome
- 9:00Securing different types of APIs
- 15:15Security as a service
- 17:45Unsecured endpoints
- 20:00Tokenbased security
- 25:10How to securely store access tokens
- 29:05Rate limiting
- 31:35Graphql security
- 37:15PKC for mobile apps
- 41:15Broken Object Level Authorization
- 44:15Token Types
- 49:45Summary
related talks
16mAPI Security Challenges and How to Address Them
38mShield your backend from outside attacks with API Managers
48mShield your backend from outside attacks with API Managers
53mCommon API Security Pitfalls
56mSecuring an API Ecosystem with OAuth 2 0
19mCreating a Solid Foundation for API Security
18mSecure your Apps and APIs with strong authentication and Adaptive Access.
34mAuthenticating your single page apps using JSON Web Tokens