43 articles tagged APIs.
The use of HTTP POST vs HTTP GET for read-only (or query) operations in REST APIs recently came up in a conversation. For this particular shop, there had been a long-standing ban on the use of GET requests for use in homegrown applications. This had been the case since before REST APIs were in…
Read article: HTTP POST vs GET: Is One More Secure For Use In REST APIs?There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…
Read article: OAuth2 Access Tokens vs API Keys — Using JWTsThis post was originally published as “OAUTH2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 3” on the Ping Identity Blog.
Read article: OAUTH2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 3This post was originally published as “OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 2” on the Ping Identity Blog.
Read article: OAuth2 Access Token Usage Strategies for Multiple Resources (APIs) Part 2This post was originally published as “OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 1” on the Ping Identity Blog.
Read article: OAUTH 2 ACCESS TOKEN USAGE STRATEGIES FOR MULTIPLE RESOURCES (APIS): PART 1This post was originally published as “API GOVERNANCE: A VITAL BUILDING BLOCK FOR API SECURITY” on the Ping Identity blog.
Read article: API GOVERNANCE: A VITAL BUILDING BLOCK FOR API SECURITYI was working with a developer not so long ago and it was explained to me that a caching layer had been added to a services layer (API Provider) to make the authorization (Fine Grained Authorization, FGA) decision more efficient for subsequent API calls. In particular, the cache contains data…
Read article: Authorization Decision Input ParametersThis diagram captures the relationships between concepts I’ve been writing about for a couple of years now.
Read article: Identity + API Management Component RelationshipsNot so long ago, someone asked me for a list of all the Apigee and API Management related material I have written. The following was my response. The recipient suggested that I post this; so, here we go.
Read article: A Brief Summary of All Things Apigee and API Management that I Have WrittenOn February 15, 2018, Bernard Harguindeguy of Elastic Beam and I filmed a webcast on The Future of API Security. The webcast can be viewed here.
Read article: The Future of API Security
