This article explains how signatures work in JWTs in general and provides a detailed example based on the EdDSA algorithm
How to handle impersonation and delegation with OAuth and OpenID Connect to enable a subject to act as a different subject.
Design patterns to allow JWTs to be validated using extended header fields and Public Key Infrastructure.
Learn about the different ways in which access tokens can be shared.
Adapt the Phantom Token Approach. A privacy-preserving token usage pattern for microservices and combine the benefits of opaque and structured tokens.
The Split Token Approach, applicable for any OAuth 2.0 ecosystem, aims to improve your tokens' security.
Security tips to consider when designing and creating APIs.
What you should consider when using JWTs in your applications.
A write-up of the top API security vulnerabilities according to OWASP and mitigating approaches.
There is a spectrum of API security implementations, and not all of them are equal. The model describes API security in ever-increasing levels of trust, complexity, and efficiency.
API security encompasses the practices, processes, and products used to ensure APIs are secure, data can be transferred safely, and malicious attacks are prevented. APIs power the connectivity of the digital world. They offer faster integrations and increased freedom of choice when it comes to products. Keeping APIs, and the data provided through them, safe and only available to the intended user is a must. In this section we have gathered information covering the most important aspects of securing APIs and microservices.