Securing APIs at Design Time
summary
Design-time security uses a concrete workflow: author an OpenAPI contract, run the audit plugin in VS Code to raise a security score (example improves from 50 to 89), gate CI/CD (reject specs under 80), run automated conformance tests that send bad types and missing tokens, and deploy an API firewall matching contract that logs attacks with ~0.2 ms overhead. Recommendations include strict JWT validation, per-endpoint scopes, rate limits, and logging for forensic traceability.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:18We dont know where APIs are
- 2:24Data validation pyramid
- 3:47API contracts
- 6:15API design first
- 8:40How to follow the workshop
- 9:28Platform
- 9:55Open APIs
- 10:45Swagger Editor
- 12:35Security Token
- 17:00Remediation
- 27:20JSON Web Tokens
- 29:03API Contract
- 32:30Security
- 36:05How is this working
- 37:53Integration
- 42:01Validation
- 46:56Logging
- 49:30Threat modeling
related talks
17mAPI Security Simplified: Practical Tips & Tools
33mWhy Developers Struggle with API Security
43mAPI Security By Design
24mAPI Security in DevSecOps: Built-In, Not Bolted On
16mDo the Right thing, shift Left!
24mMastering API Security: From Design to Deployment
25m10 steps to secure your API
33mImproving API Security Posture.