APIs
41 articles tagged APIs.
2 + Fish = Moon Rock: When Your Key Performance Indicator Dashboard Has More Charts Than Purpose
When the metrics you hold so dear no longer measure anything meaningful.
Read article: 2 + Fish = Moon Rock: When Your Key Performance Indicator Dashboard Has More Charts Than Purpose
The Year 2038 Problem: When Computers Discover Time Is Hard
For most of human history, keeping track of dates was relatively straightforward. The sun came up; the sun went down.
Read article: The Year 2038 Problem: When Computers Discover Time Is Hard
Understanding Unauthenticated Traffic: How Applications and APIs Represent The Unauthenticated User
Authentication is one of the most fundamental concepts in application security. Most developers spend considerable time designing how authenticated users are represented, authorized, and managed. Surprisingly, much less attention is given to the opposite state of users who have not authenticated at…
Read article: Understanding Unauthenticated Traffic: How Applications and APIs Represent The Unauthenticated User
Begotten & Forgotten Distributed Service Technologies
Sometime around 2012, I published a similar list (up to the point of APIs). I recently put the same list in another post. I thought having this as its own post would be useful, or, at least, amusing.
Read article: Begotten & Forgotten Distributed Service Technologies
API Design: Planned, Unplanned, Security and Utter Chaos
I’ve discussed APIs and API Management in previous blog posts. These are among my older blog posts, but the points being made are, generally, still relevant. I’ve never published a blog post exclusively about API design. I have a blog post about “API Gateways and Multiple Consumer Types” where I…
Read article: API Design: Planned, Unplanned, Security and Utter Chaos
API Gateways and Multiple Consumer Types
Sometimes at client sites, I see a separation of APIs advertised on an API Gateway based upon consumer type. Sometimes, this is unavoidable, but there should be a core set of APIs and a general push to create APIs that are reusable. Reusability of APIs is a foundational building block of API…
Read article: API Gateways and Multiple Consumer Types
Making Authorization Decisions
This blog post continues our discussion of Authorization in the API space. It will explore common authorization patterns with API Gateways and the backend API Providers. Generally, the API Gateway will apply a Coarse Grained Authorization (CGA) decision and the API Provider will implement Fine…
Read article: Making Authorization Decisions
HTTP POST vs GET: Is One More Secure For Use In REST APIs?
The use of HTTP POST vs HTTP GET for read-only (or query) operations in REST APIs recently came up in a conversation. For this particular shop, there had been a long-standing ban on the use of GET requests for use in homegrown applications. This had been the case since before REST APIs were in…
Read article: HTTP POST vs GET: Is One More Secure For Use In REST APIs?
OAuth2 Access Tokens vs API Keys — Using JWTs
There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…
Read article: OAuth2 Access Tokens vs API Keys — Using JWTs