Deconstructing REST Security
summary
Compares Basic Auth, OAuth 2.0 stateful token stores and stateless JWTs with concrete traffic math: 1,000 users × 3 TPS → 3,000 frontdoor TPS and 12,000 backend hops, showing how a stateful OAuth2 token store becomes a bottleneck while a signed cookie (JWT) flips state to the client and lets services verify with a public key without store hits. Describes Amazon-style HTTP Signatures that sign headers to prevent replay and recommends combining OAuth2/JWT at the gateway with per-service signatures in the backend.
AI-written summary · about
chapters (6)
- 0:00Start
- 5:47Baseline Architecture
- 40:34Signature Message
- 42:43Signature closeup
- 47:27OAuth and Signatures
- 51:36Observations
related talks
47mDeconstructing and Evolving REST Security
32mREST security essentials
01h 00mSupercharging OAuth 2.0 Security
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
38mAuthentication as a Microservice: Portable Customer Identity Management
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
27mManaging a State of Distrust
24mA Token Walks Into a SPA