be it conference 2015 | skrill - how to protect your rest apis with oauth
TRANSCRIPT
Page 1
How to protect your REST APIs with OAuth
15 May 2015
Page 2
• Introduction• OAuth in a nutshell• Approaches• API Gateway• ApiFest• Taking things further• Q & A
Agenda
Page 3
Hi, I’m Ivan
Introduction
Page 4
OAuth?
http://en.wikipedia.org/wiki/OAuth
OAuth in a nutshell
Page 5
Simple OAuth Flow
Page 6
• Adding validation in every service
Approaches
Page 7
Token Validation
Page 8
• Filtering requests before service code is executed
Smarter Aproach
Page 9
Token Validation Flow
Page 10
• Entirely decoupling validation
The Different Approach
Page 11
• Decouple the validation from the rest of the application
API Gateway
Page 12
API Gateway Web Service Flow
Page 13
ApiFest
• Open source (Apache 2 Licenced):http://apifest.com/https://github.com/apifest
• Authored by Rossitsa Borissova
Page 14
ApiFest
• Built-in support for OAuth2• Uses Netty• Built-in clustering support via Hazelcast• Can remap requests• Mapping configuration via xml• Allows plugging in your own code• Online reloading
Page 15
• Adding information to the token
Taking things further
Page 16
Web Service Flow
Page 17
• Adding information to the token• Reformatting the communication
Taking things further
Page 18
Web Service Flow
Page 19
• Adding information to the token• Reformatting the communication• Unifying multiple services
Taking things further
Page 20
Web Service Flow
Page 21
Q & A
Page 22
Thank you
Page 23
Skrill Ltd | Level 27 | 25 Canada Square | London E14 5LQ | UK
www.skrill.com
Skrill Ltd | Level 27 | 25 Canada Square | London E14 5LQ | UK
www.skrill.com