API Security with Membrane API Gateway

API Security Basics

• What Is a Bearer Token?
  Simple explanation of bearer token authentication for APIs with HTTP examples and step-by-step authorization flow diagrams.
• JWT API Authentication with OAuth2 Client Credentials
  Tutorial showing how an API client can get a JWT token and use it for API authentication. Membrane is not required for this tutorial.

OAuth2 and OIDC

• JWT Token Validation against Microsoft's Azure AD
  Tutorial that explains how to set up JWT validation with Azure AD
• Using OAuth2 Authentication with Postman
  Tutorial on generating and using OAuth2 tokens within Postman (Lite version supported)
• Automatic Certificate Renewal with ACME
  Tutorial on setting up automatic certificate renewal for Let's Encrypt using ACME.

Have a look at the API Gateway tutorials and the samples in the examples/oauth2 folder of the Membrane distribution.

ReDoS Protection

• ReDoS Attacks on APIs and Gateways
  What regular expression denial of service is, how backtracking makes it possible, and why APIs and OpenAPI patterns are affected.
• How to Prevent ReDoS in APIs and API Gateways
  Dangerous patterns, rules for safe regular expressions, OpenAPI patterns with maxLength, and defenses in API gateways and frameworks.
• ReDoS Protection in Membrane API Gateway
  Which Membrane features run regular expressions on client input, with safe example configurations.

Other

In the examples folder you will find more security plugins:

• GraphQL Protection
• JSON Protection
• XML Protection
• SSL/TLS
• BasicAuthentication
• ACL