Demystifying Web API Security in Azure

on YouTube ↗01h 02m

" summary

Demo builds a .NET 8 API and two clients, registers apps in Entra ID (Azure AD), and implements role-based app permissions so tokens include to-do.read/to-do.write roles. Uses client credentials for service-to-service calls and rejects unauthorized writes with 403; on-behalf-of is considered but not used because tokens originate from mixed providers. Local dev and Swagger work via PKCE, production uses managed identities to avoid secrets. Infrastructure is declared with Pulumi. The setup runs end-to-end in the demo.

AI-written summary · about

" chapters (12)

1. 0:00Web API security challenges
2. 1:12Monoliths to microservices security
3. 3:18Azure AD and OAuth2 authentication
4. 5:05Zero trust and internal security
5. 9:16Azure AD as identity provider
6. 14:39Authorizing callers with permissions
7. 22:52Azure AD API security setup
8. 31:42Role-based authorization in ASP.NET Core
9. 46:34Securing server API demo
10. 46:58External client auth demo
11. 53:46Internal client auth demo
12. 1:00:54Summary

" related talks

• 52mDemystifying Web API Security in AzureJimmy Bogard · DevConf 2023
• 53mWeb API Security With Azure Active DirectoryRainer Stropek, Simon Opelt · Global Azure Austria 2021
• 01h 03mBuilding Secure Microservices in AzureJimmy Bogard · NDC Oslo 2022
• 01h 05mBuilding Secure Microservices in AzureJimmy Bogard · NDC London 2023
• 55mReal World Guide to Web API authentication on AzureHeather Downing · NDC Copenhagen 2019
• 01h 03mServerless and App Service Security on AzureMahesh Krishnan, Pratik Khasnabis · NDC Sydney 2019
• 41mReal World Guide to Web API authentication on AzureHeather Downing · NDC London 2020
• 50mSecuring .NET Apps and Microservices in AzureVictoria Almazova · .NET fwdays'20 online conference