Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
Regardless of your application architecture or front-end type, there are a variety of common attack types that the application security architecture’s capabilities must protect against. I’ve talked about these topics briefly before here, here, and here.
Read article: Prevent XSS and Other Common Attacks on Your AppFor the small business owner, should the power going out mean you can’t make money? Should the computer system going down for 20 minutes mean a restaurant can’t take or cook orders any longer? Some basic level of preparation for anything other than ideal circumstances and commonsense needs to be…
Read article: Practical Business Continuity For The Small OrganizationFor the small business owner, should the power going out mean you can’t make money? Should the computer system going down for 20 minutes mean a restaurant can’t take or cook orders any longer? Some basic level of preparation for anything other than ideal circumstances and commonsense needs to be…
Read article: Practical Business ContinuityAuthentication is described in this post.
Read article: Static Credentials Must Not Be Used In The BrowserThis post will introduce a generic set of database / datastore security requirements that be used as a starting point when developing a database security strategy.
Read article: Datastore Security RequirementsFirst, let’s get the usual introductions out of the way. For an in-depth discussion of what Authorization is, check out this post. For a complete introduction to Authorization concepts see my Authorization Series. This post continues my long-running Authorization Series. In this post, we’re going…
Read article: Application Front-Ends Must Not Make Authorization DecisionsSometimes at client sites, I see a separation of APIs advertised on an API Gateway based upon consumer type. Sometimes, this is unavoidable, but there should be a core set of APIs and a general push to create APIs that are reusable. Reusability of APIs is a foundational building block of API…
Read article: API Gateways and Multiple Consumer TypesFor anyone who has been paying attention, this blog post has been a long-time coming for multiple reasons. First, this is my first blog post in a couple of years — I’ve been heads down on a couple of projects for awhile now. This is literally the first time I’ve “come up for air” since the last…
Read article: RFC 9068: A JWT-Based OAuth2 Access Token Format StandardThis blog post continues our discussion of Authorization in the API space. It will explore common authorization patterns with API Gateways and the backend API Providers. Generally, the API Gateway will apply a Coarse Grained Authorization (CGA) decision and the API Provider will implement Fine…
Read article: Making Authorization DecisionsLooking for something specific? Browse all 124 topics.
