WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Apr 29, 2022

Architecting API Security

Philippe De Ryck

An attacker breaches your API gateway and suddenly gains unchecked access across your trusted network. Prevent catastrophic lateral movement by shifting from perimeter defenses to a zero-trust architecture.

Pause
Mute Enter Fullscreen
#1 about 4 min

Designing APIs for security from day one

Prioritizing early architectural design prevents critical authorization and authentication flaws commonly found in real-world application deployments.

#2 about 3 min

Establishing a baseline modern API architecture

A typical modern infrastructure utilizes reverse proxies and API gateways to route authorized traffic to monolithic or microservice components.

#3 about 9 min

How internal vulnerabilities breach perimeter security

Exploiting standard processes like image conversion demonstrates why relying solely on perimeter defenses leaves internal trusted zones entirely defenseless against remote code execution.

#4 about 6 min

Containing lateral threats with service compartmentalization

Isolating untrusted or highly sensitive services into distinct trust zones mitigates widespread infrastructure compromise when targeted individual components fail.

#5 about 5 min

Enforcing zero trust policies with inter-API authentication

Implementing strict caller verification and explicit communication paths stops compromised internal services from arbitrarily traversing the backend network.

#6 about 6 min

Forwarding authentication state via token relay

Relaying identity contexts past the external gateway empowers internal microservices to execute precise object-level authorization decisions for individual users.

#7 about 3 min

Security drawbacks of exposing JWTs to clients

Delivering raw JSON web tokens to frontend clients incurs large network overheads, complicates session revocation, and risks leaking sensitive backend claim data.

#8 about 4 min

Obfuscating JWTs with API gateway reference tokens

Gateways can maintain server-side token state and issue opaque reference identifiers to clients to obscure internal authorization topologies and simplify session invalidation.

#9 about 2 min

Key architectural takeaways for building secure APIs

Assuming breach necessitates prioritizing simple, compartmentalized architectural solutions that leverage edge gateways to shield internal implementation complexities.

#10 about 10 min

Audience Q&A on fine-grained access and JWT encryption

Addressing inquiries regarding career paths, configuring fine-grained access with open policy agents, and the challenges of managing keys for token encryption.

Matching moments

6:44 min

Designing a resilient API gateway architecture

Lars Hesel Christensen +1 · LIVE

3:15 min

The current state of enterprise APIs and security trends

Pratim Bhosale Pratim Bhosale · World Congress 2025

9:56 min

Final code walk-through and audience Q&A session

Germán Álvarez · LIVE

1:36 min

Securing exposed application programming interfaces against unauthenticated access

Jasmin Azemović Jasmin Azemović · World Congress 2023

2:31 min

Addressing insecure design through early threat modeling

Christian Wenz Christian Wenz · World Congress 2026 Europe

3:45 min

Applying zero trust architecture to backend microservices

Jan Peer Stöcklmair Jan Peer Stöcklmair · World Congress 2026 Europe

More from WeAreDevelopers LIVE

Fake or News - Claude's DNA Discovery, Quick Cloning & Crime on Insta thumbnail
6:07
1 day ago

Fake or News - Claude's DNA Discovery, Quick Cloning & Crime on Insta

Andrew MacLean, Daniel Cranney, Christian Heilmann

WeAreDevelopers LIVE - Playing in Production thumbnail
1:06:40
1 day ago

WeAreDevelopers LIVE - Playing in Production

Andrew MacLean, Daniel Cranney, Christian Heilmann

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
15 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
22 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
24 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
29 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Related videos

Bullet-Proof APIs: The OWASP API Security Top Ten thumbnail
25:46
World Congress 2025 • about 1 year ago

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Lessons learned from observing a billion API requests thumbnail
23:47
World Congress 2025 • about 1 year ago

Lessons learned from observing a billion API requests

Pratim Bhosale

Trust Issues: Because Zero-Trust Isn’t Optional Anymore thumbnail
28:46
World Congress 2026 Europe • 3 months ago

Trust Issues: Because Zero-Trust Isn’t Optional Anymore

Jan Peer Stöcklmair

An Opinionated Guide to Bulletproof APIs thumbnail
27:13
World Congress 2026 Europe • 3 months ago

An Opinionated Guide to Bulletproof APIs

Rustam Mehmandarov

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect thumbnail
24:07
World Congress 2026 Europe • 3 months ago

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect

Alexander Schwartz

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.