Cloud Native Data Security with OAuth

Chapter 5. Secure API Development

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the authors’ raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 5th chapter of the final book. The GitHub repo is available at https://github.com/curityio/cloud-native-oauth-security-examples.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

In this chapter, we focus on secure API development by showing how to implement zero-trust authorization in OAuth-secured APIs. We first explain how to enable unified API security with JWT access tokens. You then learn how to validate JWT access tokens and how to utilize the token data to implement API authorization logic. We then discuss how to handle access token expiration to ensure end-to-end API reliability. As you have to test your APIs, we also show a productive method for testing zero-trust APIs. Finally, we demonstrate the theory with an API code example.

Let’s get started by showing how JWT access tokens can enable you to use the same API security code for all types of clients.

Unified API Security with JWT Access Tokens

Different types of client applications have their own best practices for sending access tokens. You should understand that your API ...