1 of 31

Best Practices�for Building Secure APIs

Navendu Pottekkat

@sudo_navendu

2 of 31

I’m Navendu

Developer Advocate at API7.ai

Maintainer of Apache APISIX

Former CNCF Maintainer

GSoC and LFX Mentor

@sudo_navendu

3 of 31

The Need for Secure APIs

@sudo_navendu

4 of 31

The Need for Secure APIs

@sudo_navendu

5 of 31

The Need for Secure APIs

@sudo_navendu

6 of 31

The Need for Secure APIs

@sudo_navendu

7 of 31

API Gateways: The Entry Points

@sudo_navendu

8 of 31

API Gateways: The Entry Points

@sudo_navendu

9 of 31

API Gateways: The Entry Points

“software that takes an application user’s request, routes it to one or more backend services, gathers the appropriate data and delivers it to the user in a single, combined package.

It also provides analytics, layers of threat protection and other security for the application.”

@sudo_navendu

10 of 31

API Gateways: The Entry Points

Apache APISIX

High performance cloud native API gateway

Load balancing, Canary release, Circuit breaking, Authentication, Observability and more.

apisix.apache.org

@sudo_navendu

11 of 31

API Gateways

For Security

@sudo_navendu

12 of 31

API Gateways

For Security

@sudo_navendu

13 of 31

Authentication

@sudo_navendu

14 of 31

Authentication

@sudo_navendu

15 of 31

Request Validation

@sudo_navendu

16 of 31

Request Validation

@sudo_navendu

17 of 31

IP Filtering

@sudo_navendu

18 of 31

IP Filtering

@sudo_navendu

19 of 31

Cross-Site Request Forgery

@sudo_navendu

20 of 31

Cross-Site Request Forgery

@sudo_navendu

21 of 31

Rate Limiting

@sudo_navendu

22 of 31

Rate Limiting

@sudo_navendu

23 of 31

HTTPS

@sudo_navendu

24 of 31

HTTPS

@sudo_navendu

25 of 31

Continuous Monitoring

@sudo_navendu

26 of 31

Continuous Monitoring

@sudo_navendu

27 of 31

Kubernetes-Native API Gateways?

@sudo_navendu

28 of 31

Kubernetes-Native API Gateways?

Kubernetes Ingress

@sudo_navendu

29 of 31

Kubernetes-Native API Gateways?

APISIX Ingress

@sudo_navendu

30 of 31

Kubernetes-Native API Gateways?

Kubernetes Gateway API

gateway-api.sigs.k8s.io

@sudo_navendu

31 of 31

Questions?

@sudo_navendu