In the article "The importance of threat protection for restful web
services", I presented a number of content-based threats for XML. When
protecting an endpoint from XML based attacks, not only are payloads scanned
for code injections, malicious entity declarations and parser attacks, XML
documents are actually validated against strict schemas that clearly describe
expected document structures. Enforcing this type of compliance at the edge,
in a SOA gateway for example, minimizes the risk of attacks of the Web
service endpoint. Structure definition languages such as XML Schema
Definition (XSD), schematron, XPath are all helpful tools in describing the
type of data and structure of XML documents that are expected at runtime.
alternative to XML and already established as the preferred content-typ... (more)
I just found out we had record attendance for Wednesday’s API Tech Talk.
Clearly, there’s an appetite for the topic of OAuth risk mitigation.
With our digital lives scattered across so many services, there is great
value in technology that lets us control how these service providers interact
on our behalf. For providers, making sure this happens in a secure way is
critical. Recent hacks associated with improperly-secured OAuth
implementations show that OAuth-related security risks need be taken
When in doubt, take a second look at the security considerations of the spe... (more)
SOA Best Practices Digest
Although certain RESTful web services are of a ‘public’ nature and do not
have specific security requirements such as authentication and authorization,
any service that has an entry point from an untrusted network is subject to
attack and proper threat protection measures are always an essential
RESTful web services are closely aligned to the web itself and as such
inherit all traditional threats from the web. Although network level threats
are well understood and addressed by traditional firewall infrastructure,
RESTful web services typ... (more)
In terms of OAuth enterprise tooling, a lot of focus is given to
OAuth-enabling APIs exposed by the enterprise itself. Naturally, the demand
for this reflects today’s reality where the enterprise is increasingly
playing the role of an api provider. However, many enterprise integration use
cases involving cloud-based services puts the enterprise in the role of API
consumer, rather than provider. And as the number of enterprise applications
consuming these external APIs grows, and the number of such external APIs
themselves grows, point-to-point OAuth handshakes become problematic.... (more)
The adoption of cloud by organizations looking for more efficient ways to
deploy their own IT assets or as a means to offset the burden of data
management drives the need for identity federation in the enterprise.
Compounding this is the mobile effect from which there is no turning back.
Data must be available any time, from anywhere and the identities accessing
it must be asserted on mobile devices, in cloud zones, always under the
stewardship of the enterprise.
APIs serve federation by enabling lightweight delegated authentication
schemes based on OAuth handshakes using the sa... (more)