Application Gateway Security What Developers Really Need to Know
summary
Defines an application gateway as a Layer 7 proxy that inspects methods, MIME types and payloads, terminates SSL in many deployments and enforces regex/header rules; recommends a concrete three-step workflow—assess, collaborate, evolve—so devs supply endpoint inventories, exact regex or UTF-8/length rules and release calendars. Cites tools and mitigations: OWASP CRS, ModSecurity, Burp Suite, curl/mitm; warns virtual patching is temporary, gives a real failure where chat broke from ASCII-only rules and a case with 15 reported vulnerabilities where only the first had the report.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:58Agenda
- 3:06Application Gateway Overview
- 5:42Where Does Application Gateway Play
- 7:18Application Gateway Tuning
- 10:42The Problem
- 11:12The Disconnect
- 11:44Parameters Cause Problems
- 13:10False Positives
- 15:25Three Part Strategy
- 16:11Assess
- 18:38Collaborate
- 21:13Evolve
- 28:33Release New Features
- 32:16Pen Test
- 38:23A cautionary tale
- 41:19Conclusion
related talks
24mStandard Classification: Application Gateway: What is it and how can you ...
28mAPI Gateway: critical component of your digital architecture
01h 04mProtect Your Applications with Azure WAF and Application Gateway
46mAPI Gateway Recipes: Solutions for Operation, Integration & Security
14mDeveloper Guide
16mAPI Security Challenges and How to Address Them
33mImproving API Security Posture.
52mApplication Security at DevOps Speed and portfolio scale