Cloud Native Data Security with OAuth

Chapter 8. Proxies, Gateways, and Sidecars

You have now seen how to design a zero trust architecture for APIs that use token-based security. APIs commonly consist of many services that need to communicate. Microservices in a backend cluster often call each other directly, but you can also place proxy-based infrastructure between APIs. This chapter shows how you can involve this type of middleware in API security.

We start by explaining how you can use HTTP proxies during API communication for egress and ingress traffic. Next, we summarize the role of an API gateway. We outline how API gateways fit into the cloud native landscape, the problems they solve, and the details of how you expose APIs from your cluster. We illustrate how you can terminate tokens in API gateways, to translate from client-specific API message credentials to the JWT access tokens that your APIs need. We then discuss the role of a sidecar. We highlight which security tasks a sidecar can perform on behalf of the API, and which tasks the API should manage itself.

We finish up the chapter with a Kubernetes example. This example shows you how to integrate an API with an API gateway and get an external API URL. The example includes a client that you can run to call that URL with an opaque access token. The API gateway performs token termination and translates the opaque token to a JWT, which it forwards to the API. The API then performs the main security using the JWT access token.

First, though, let’s explain ...