Building a secure BFF at Postman
summary
Postman describes building a public BFF that enforces principle of least privilege in access policies, pins dependency versions and runs Snyk and npm audit in CI, and uses Postman collections as automated security regression tests (including an AWS MFA audit) to catch breaks. Requests carry trace tokens to prevent IDORs, logs are redacted, CSP starts in report‑only, and health checks gate deployments. The claimed result: fewer regressions and faster, more measurable security checks integrated into CI.
AI-written summary · about
chapters (27)
- 0:00Intro
- 0:15Microservices vs monoliths
- 1:37API gateways
- 2:21Security concerns
- 2:58Security parameters
- 3:47BFF overview
- 4:17Service
- 5:16Critical Path
- 6:10Least Privilege
- 7:01Fail Early
- 7:48Example
- 11:45Using API as a forcing function
- 12:59Strict versions
- 14:41Linking
- 18:33Authentication
- 20:16Authorization
- 20:52Access Token
- 21:08Indirect Object Referencing
- 22:10Logging
- 23:35HTTPS
- 25:15SSD
- 26:52Browser Support
- 29:14AWS MFA Audit
- 30:30Health Check
- 32:36VAPT
- 34:07Building a secure platform
- 35:19Summary
related talks
30mLeveraging Postman for Security Testing
22mAPI Security Testing with Postman: Best Practices and Techniques
15mIntegrating API Security Testing Into the Postman Lifecycle
40mApisecure, 14 & 15 March 2023 - Ian Douglas, Senior Developer Advocate at Postman.
33mMinimum Viable Security
01h 04mTransformation Blueprint for Developer-Centric Application Security
39mSecurity Tooling in Your DevOps Pipeline
35mBuilding Security In: Using Cloud Foundry to Secure CF Apps