In this chapter, we focus on secure API development by showing how to implement zero trust authorization in OAuth-secured APIs. We first explain how to enable unified API security with JWT access tokens. You then learn how to validate JWT access tokens and how to utilize the token data to implement API authorization logic. We then discuss how to handle access token expiration to ensure end-to-end API reliability. As you have to test your APIs, we also show a productive method for testing zero trust APIs. Finally, we demonstrate the theory with an API code example.
Let’s get started by showing how JWT access tokens can enable you to use the same API security code for all types of clients.
Unified API Security with JWT Access Tokens
Different types of client applications have their own best practices for sending access tokens. You should understand that your API code does not need to deal with all of these variations. The API should only ever need to deal with a single unified type of message credential. An API gateway can manage any client-specific security differences so that APIs receive an access token in a format that enables the best API security. That format is a JSON Web Token (JWT). Figure 5-1 illustrates the architecture.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
Julian F.
Head of Cybersecurity
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.
Addison B.
Field Engineer
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.
Amir M.
Data Platform Tech Lead
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
