The State of Securing RESTful APIs with Spring
summary
Argues that APIs must use HTTPS everywhere (Google reports ~1% CPU overhead) and avoid naive auth patterns; recommends password hashing with adaptive algorithms like bcrypt/PBKDF2 (bcrypt slows cracking from billions of SHA hashes/sec to ~100–200 H/s, turning 25M dumps into centuries to crack). Shows practical tooling: Hashcat benchmarks, JWT algorithm pitfalls (alg=none and RSA vs HMAC attacks), and a concrete stateful option: Spring Session with Redis or header lookup to scale sessions and protect against CSRF.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:53Security mindset
- 14:58HTTPS everywhere
- 23:11Password storage
- 35:03Stateless authentication
- 48:08Spring Session
- 1:00:17OAuth2 overview
- 1:04:17Authorization layers
- 1:14:51CSRF protection
- 1:23:03Q&A and summary
