1.
1© 2018 Rogue Wave Software, Inc. All Rights Reserved.

2.
2© 2018 Rogue Wave Software, Inc. All Rights Reserved.
API Security Layers
Transport layer
Client authentication
and authorization
Content security

3.
3© 2018 Rogue Wave Software, Inc. All Rights Reserved.
In summary…
• mTLS: ensures client authenticity
• OAuth: ensures client authorization
• JWT: ensures message integrity, confidentiality,
and non-repudiation.
Ensure that each request is coming from a trusted source

4.
5© 2018 Rogue Wave Software, Inc. All Rights Reserved.
Add layers of security to an API
- let’s see it for real!

5.
6© 2018 Rogue Wave Software, Inc. All Rights Reserved.
Demo overview
• API: open banking Accounts-and-Transactions
– Apply mutual TLS
– Apply Oauth2.0
– Apply JOSE Security / Open Banking security
– Apply additional message security

6.
7© 2018 Rogue Wave Software, Inc. All Rights Reserved.
Additional security aspects to
consider
• MFA (SCA)
User authentication: can we trust the user?
• Injection
• Cross-site scripting
• Request overload
• …
Can we trust what the user is doing?

7.
8© 2018 Rogue Wave Software, Inc. All Rights Reserved.
Conclusion
API security: There’s quite a lot to it
…but there’s useful specifications to help you out.
Implementing security standards is far
from trivial
…don’t do it yourself
…excellent tools in the market to help you

8.
9© 2018 Rogue Wave Software, Inc. All Rights Reserved.

9.
10© 2018 Rogue Wave Software, Inc. All Rights Reserved.