Cloud Native Data Security with OAuth

Preface

When you build digital solutions, your users run applications that access data over the internet. These applications can run on browsers, mobile devices, servers, or any other platform. They have one thing in common, though: they are API clients, and that means they call APIs to access data. APIs must enable secure data access because the data they serve may include intellectual property, personal data belonging to citizens or users, or information belonging to business partners. To protect data and access to it, you must secure both APIs and the application fetching the data. Such security requirements can originate from compliance and regulatory initiatives. One example is the European Union’s General Data Protection Regulation (GDPR), which governs user privacy and consent.

Managing data security and privacy in APIs and API clients is a difficult problem that requires an architectural solution. Your APIs must process user identities correctly so that each user gains access to only the correct API resources. To achieve that, you must apply business authorization in APIs. The exact authorization rules depend, of course, on your business use cases. Ideally, you ensure that every API request from a client includes an unforgeable and least-privilege API message credential. This credential conveys business permissions. You first verify such a credential in the API before you enforce your particular rules. When you protect every API request in this manner, for both external ...