Shield Right for APIs with Runtime Protection

In the previous chapter, we examined how to secure APIs using best practices for frameworks and languages. While this is important for improving API security, ensuring that your APIs are protected at runtime in production is equally important. This chapter will examine various methods to shield right (by shield right, I am referring to various protections for APIs that can be deployed at runtime, as opposed to design or development time) for API security.

First, we will examine basic practices to harden and secure the host platforms your APIs run on, whether Docker containers or operating systems. Then, we will examine the stalwart of runtime defense: the Web Application Firewall (WAF), and how this can be applied to protect APIs. API gateways and API managers form the core components of your arsenal in protecting APIs, and we will examine in detail the various protections these can bring to your APIs. The final tier of defending APIs...