REST API Security Jamie Wallace EBSCO LearningExpress Physics 25 - - PowerPoint PPT Presentation

▶
rest api security
SMART_READER_LITE
LIVE PREVIEW

REST API Security Jamie Wallace EBSCO LearningExpress Physics 25 - - PowerPoint PPT Presentation

Mar 15, 2023 331 likes •913 views

REST API Security Jamie Wallace EBSCO LearningExpress Physics 25 Years in Software Director of Software Development What is REST? Security? Solutions Implementation What is REST? Security? Solutions Implementation What is REST?

slide-1
SLIDE 1

REST API Security

Jamie Wallace EBSCO LearningExpress

slide-2
SLIDE 2

Physics 25 Years in Software Director of Software Development

slide-3
SLIDE 3

What is REST? Security? Solutions Implementation

slide-4
SLIDE 4

What is REST? Security? Solutions Implementation

slide-5
SLIDE 5

What is REST? Security? Solutions Implementation

slide-6
SLIDE 6

What is REST? Security? Solutions Implementation

slide-7
SLIDE 7

REST

slide-8
SLIDE 8

RE S T

tate presentational ransfer

slide-9
SLIDE 9

CRUD HTTP verbs

using

slide-10
SLIDE 10

API key

most web services only use an

slide-11
SLIDE 11 Request Request Request Validator API Key
slide-12
SLIDE 12 Key Request Validator API
slide-13
SLIDE 13 Key Request Validator API
slide-14
SLIDE 14 Request Validator API
slide-15
SLIDE 15

Server Side Client Side

slide-16
SLIDE 16

Authorized client Valid and unmodified request No replay attacks All users

slide-17
SLIDE 17

Authorized client Valid and unmodified request No replay attacks All users

slide-18
SLIDE 18

Authorized client Valid and unmodified request No replay attacks All users

slide-19
SLIDE 19

Authorized client Valid and unmodified request No replay attacks All users

slide-20
SLIDE 20

Domain Cookie Solution Time based One Time Password JSON Web Token

slide-21
SLIDE 21 Request SessionID Header SessionID Cookie Validator API
slide-22
SLIDE 22 Request SessionID Header SessionID Cookie Validator API
slide-23
SLIDE 23 Request SessionID Header SessionID Cookie Validator API
slide-24
SLIDE 24 Request Validator API
slide-25
SLIDE 25

Single Domain Multiple Domain

slide-26
SLIDE 26 Request SessionID Header SessionID Cookie Validator API
slide-27
SLIDE 27

Domain Cookie Solution Time based One Time Password JSON Web Token

slide-28
SLIDE 28 Time Periods Key HMAC
slide-29
SLIDE 29 TOTP Time Periods Key HMAC
slide-30
SLIDE 30 Ç Key HMAC TOTP
slide-31
SLIDE 31 Request Validator API TOTP
slide-32
SLIDE 32 Request Validator API TOTP
slide-33
SLIDE 33 Request Validator API TOTP
slide-34
SLIDE 34 Request Validator API
slide-35
SLIDE 35

Domain Cookie Solution Time based One Time Password JSON Web Token

slide-36
SLIDE 36 Header Key HMAC Payload
slide-37
SLIDE 37 Signature Key Payload Header Signature HMAC
slide-38
SLIDE 38 Key Payload Header HMAC Signature
slide-39
SLIDE 39 Request Validator API JWT
slide-40
SLIDE 40 Request Validator API JWT
slide-41
SLIDE 41 Request Validator API JWT
slide-42
SLIDE 42 Request Validator API
slide-43
SLIDE 43

Application Fingerprint

slide-44
SLIDE 44

JWT with

Signature Service

slide-45
SLIDE 45 TS String TS 115GHI 115DEF 115ABC Key 10 20 30 HMAC
slide-46
SLIDE 46 115GHI String TS TS 115DEF 115ABC Key 10 20 30 HMAC
slide-47
SLIDE 47 115GHI String TS TS 115DEF 115ABC Key 10 20 30 HMAC Hash
slide-48
SLIDE 48

Encrypting JWT with

Encryption Service

slide-49
SLIDE 49 TS String TS 115GHI 115DEF 115ABC Key 10 20 30 HMAC
slide-50
SLIDE 50 115GHI String TS TS 115DEF 115ABC Key 10 20 30 HMAC
slide-51
SLIDE 51 115GHI String TS TS 115DEF 115ABC Key 10 20 30 HMAC Encrypted
  • r Decrypted
String
slide-52
SLIDE 52

Client Manager Validator Signature Service Encryption Service Key Store

slide-53
SLIDE 53

Client Manager Validator Signature Service Encryption Service Key Store

slide-54
SLIDE 54

Client Manager Validator Signature Service Encryption Service Key Store

slide-55
SLIDE 55

Client Manager Validator Signature Service Encryption Service Key Store

slide-56
SLIDE 56

Client Manager Validator Signature Service Encryption Service Key Store

slide-57
SLIDE 57

Q & A