Deconstructing and Evolving REST Security
summary
Compares basic auth, OAuth2 bearer tokens, JWTs and Amazon-style HTTP signatures against a baseline four-hop microservice load of 15,000 TPS and 1,000 users at 3 requests/sec. Shows how JWTs push state to clients, allow stateless backend verification with a public key, and drop token-store load from ~55% to 0.55% of traffic. Demonstrates actual Authorization header formats, SHA-256 signing and how pairing a short signed API key with a JWT yields a Proof-of-Possession two-factor pattern.
AI-written summary · about
chapters (6)
- 0:00The challenge of security
- 5:40Basic authentication flaws
- 10:57OAuth 2 limitations
- 19:59Digital signatures and hashing
- 27:30Securing architectures with JWT
- 38:52Advanced patterns and conclusion
related talks
53mDeconstructing REST Security
32mREST security essentials
35mSecure JAX-RS
01h 00mSupercharging OAuth 2.0 Security
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
38mAuthentication as a Microservice: Portable Customer Identity Management
39mMicroservice Security via MicroProfile JWT
27mAuthentication for the REST of us