Securing Access to APIs

In this chapter, we will see how we can secure access to the APIs and web pages exposed by the edge server introduced in the previous chapter. We will learn how to use HTTPS to protect against eavesdropping on external access to our APIs, and how to use OAuth 2.0 and OpenID Connect to authenticate and authorize users and client applications to access our APIs. Finally, we will use HTTP Basic authentication to secure access to the discovery server, Netflix Eureka.

The following topics will be covered in this chapter:

• An introduction to the OAuth 2.0 and OpenID Connect standards
• A general discussion on how to secure the system landscape
• Protecting external communication with HTTPS
• Securing access to the discovery server, Netflix Eureka
• Adding a local authorization server to our system landscape
• Authenticating and authorizing API access using OAuth 2.0 and OpenID Connect
• Testing with the local authorization server...