
Advanced API Security
Description
Alles über E-Books | Antworten auf Fragen rund um E-Books, Kopierschutz und Dateiformate finden Sie in unserem Info- & Hilfebereich.
More details
Other editions
New editions

Additional editions

Person
Content
- Intro
- Contents at a Glance
- Contents
- About the Author
- About the Technical Reviewer
- Acknowledgments
- Introduction
- Chapter 1: Managed APIs
- The API Evolution
- API vs. Managed API
- API vs. Service
- Discovering and Describing APIs
- Managed APIs in Practice
- Twitter API
- Salesforce API
- Summary
- Chapter 2: Security by Design
- Design Challenges
- User Comfort
- Performance
- Weakest Link
- Defense in Depth
- Insider Attacks
- Security by Obscurity
- Design Principles
- Least Privilege
- Fail-Safe Defaults
- Economy of Mechanism
- Complete Mediation
- Open Design
- Separation of Privilege
- Least Common Mechanism
- Psychological Acceptability
- Confidentiality, Integrity, Availability (CIA)
- Confidentiality
- Integrity
- Availability
- Security Controls
- Authentication
- Something You Know
- Something You Have
- Something You Are
- Authorization
- Discretionary Access Control (DAC) vs. Mandatory Access Control (MAC)
- Nonrepudiation
- Auditing
- Security Patterns
- Direct Authentication Pattern
- Managing Credentials
- Biometric Authentication
- Sealed Green Zone Pattern
- Least Common Mechanism Pattern
- Brokered Authentication Pattern
- Policy-Based Access Control Pattern
- Threat Modeling
- Summary
- Chapter 3: HTTP Basic/Digest Authentication
- HTTP Basic Authentication
- HTTP Digest Authentication
- Summary
- Chapter 4: Mutual Authentication with TLS
- Evolution of TLS
- How TLS Works
- TLS Handshake
- Application Data Transfer
- Summary
- Chapter 5: Identity Delegation
- Direct Delegation vs. Brokered Delegation
- Evolution of Identity Delegation
- Google ClientLogin
- Google AuthSub
- Flickr Authentication API
- Yahoo! Browser-Based Authentication (BBAuth)
- Summary
- Chapter 6: OAuth 1.0
- The Token Dance
- Temporary-Credential Request Phase
- Resource-Owner Authorization Phase
- Token-Credential Request Phase
- Invoking a Secured Business API with OAuth 1.0
- Demystifying oauth_signature
- Three-Legged OAuth vs. Two-Legged OAuth
- OAuth WRAP
- Summary
- Chapter 7: OAuth 2.0
- OAuth WRAP
- Client Account and Password Profile
- Assertion Profile
- Username and Password Profile
- Web App Profile
- Rich App Profile
- Accessing a WRAP-Protected API
- WRAP to OAuth 2.0
- OAuth 2.0 Grant Types
- Authorization Code Grant Type
- Implicit Grant Type
- Resource Owner Password Credentials Grant Type
- Client Credentials Grant Type
- OAuth 2.0 Token Types
- OAuth 2.0 Bearer Token Profile
- OAuth 2.0 Client Types
- OAuth 2.0 and Facebook
- OAuth 2.0 and LinkedIn
- OAuth 2.0 and Salesforce
- OAuth 2.0 and Google
- Authentication vs. Authorization
- Summary
- Chapter 8: OAuth 2.0 MAC Token Profile
- Bearer Token vs. MAC Token
- Obtaining a MAC Token
- Invoking an API Protected with the OAuth 2.0 MAC Token Profile
- Calculating the MAC
- MAC Validation by the Resource Server
- OAuth Grant Types and the MAC Token Profile
- OAuth 1.0 vs. OAuth 2.0 MAC Token Profile
- Summary
- Chapter 9: OAuth 2.0 Profiles
- Token Introspection Profile
- XACML and OAuth Token Introspection
- Chain Grant Type Profile
- Dynamic Client Registration Profile
- Token Revocation Profile
- Summary
- Chapter 10: User Managed Access (UMA)
- ProtectServe
- UMA and OAuth
- UMA Architecture
- UMA Phases
- UMA Phase 1: Protecting a Resource
- UMA Phase 2: Getting Authorization
- UMA Phase 3: Accessing the Protected Resource
- UMA APIs
- Protection API
- Authorization API
- The Role of UMA in API Security
- Summary
- Chapter 11: Federation
- Enabling Federation
- Brokered Authentication
- SAML 2.0 Profile for OAuth: Client Authentication
- SAML 2.0 Profile for OAuth: Grant Type
- JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants
- Summary
- Chapter 12: OpenID Connect
- A Brief History of OpenID Connect
- Understanding OpenID Connect
- Anatomy of the ID Token
- OpenID Connect Request
- Requesting User Attributes
- Grant Types for OpenID Connect
- Requesting Custom User Attributes
- OpenID Connect Discovery
- OpenID Connect Identity Provider Metadata
- OpenID Connect Dynamic Client Registration
- OpenID Connect for Securing APIs
- Summary
- Chapter 13: JWT, JWS, and JWE
- JSON Web Token
- JOSE Working Group
- JSON Web Signature
- Signature Algorithms
- Serialization
- JSON Web Encryption
- Content Encryption vs. Key Wrapping
- Serialization
- Summary
- Chapter 14: Patterns and Practices
- Direct Authentication with the Trusted Subsystem Pattern
- Single Sign-On with the Delegated Access Control Pattern
- Single Sign-On with the Integrated Windows Authentication Pattern
- Identity Proxy with the Delegated Access Control Pattern
- Delegated Access Control with the JSON Web Token Pattern
- Nonrepudiation with the JSON Web Signature Pattern
- Chained Access Delegation Pattern
- Trusted Master Access Delegation Pattern
- Resource Security Token Service (STS) with the Delegated Access Control Pattern
- Delegated Access Control with the Hidden Credentials Pattern
- Summary
- Index
System requirements
File format: PDF
Copy protection: Watermark-DRM (Digital Rights Management)
System requirements:
- Computer (Windows; MacOS X; Linux): Use the free software Adobe Reader, Adobe Digital Editions, or any other PDF viewer of your choice (see eBook Help).
- Tablet/Smartphone (Android; iOS): Install the free app Adobe Digital Editions or another reading app for eBooks, e.g., PocketBook (see eBook Help).
- E-reader: Bookeen, Kobo, Pocketbook, Sony, Tolino and many more (only limited: Kindle).
The file format PDF always displays a book page identically on any hardware. This makes PDF suitable for complex layouts such as those used in textbooks and reference books (images, tables, columns, footnotes). Unfortunately, on the small screens of e-readers or smartphones, PDFs are rather annoying, requiring too much scrolling.
This eBook uses Watermark-DRM, a „soft” copy protection. This means that there are no technical restrictions to prevent illegal distribution. However, there is a personalised watermark embedded in the eBook that can be used to identify the purchaser of the eBook in the event of misuse and to provide evidence for legal purposes.
For more information, see our eBook Help page.