API security starts with authentication and authorization, then data security and availability. In this post, I will review security considerations for an API gateway and how the capabilities of the Kong Gateway address them. First, let’s review different aspects of API security in detail.
It’s commonly accepted now that APIs and microservices are the future of how software will be built. The introduction of application programming interfaces (APIs) first enabled development teams to expose services to the internet and provide value to their customers and partners.
Postman is a great tool for API testing during development. It’s GUI is simple to learn and ubiquitous. However, manually writing test cases for local development gets tedious fast if you have a lot of endpoints. Meticulously entering every detail for every use case takes forever. Also, if you get one HTTP Header or parameter wrong, it can take hours to diagnose. And even when it’s done, the API tests are almost immediately out of date because the API contract changes.
Microservices architecture. Many organizations today recognize it enables faster and easier software changes over more traditional monoliths. Microservices have become the backbone for how organizations develop cloud-native applications – programs that run independently in containers designed for cloud computing architectures.
In this episode of Kongcast, Jeff Taylor, senior product manager at Okta, tells and shows us how to speed up microservices security and take the burden off developers by managing auth with an API gateway.