Cloud Native Data Security with OAuth A Scalable Zero Trust Architecture (Gary Archer, Judith Kahrer etc.) (z-library.sk, 1lib.sk, z-lib.sk)
, ,
Cloud Native
With the growth of cloud native applications, developers increasingly rely on APIs to make everything work. But security often lags behind, making APIs an attractive target for bad actors looking to access valuable business data. OAuth is a popular way to address this issue, but this open standard doesn't provide sufficient guidelines for using API tokens to protect business data. That alone can lead to vulnerabilities and invite data breaches. By using cloud native components in Kubernetes or similar platforms, organizations can implement a scalable, future-proof security architecture for their systems that follows a zero-trust approach to protect business data. You'll access tokens, claims, and token design with an emphasis on an API-first approach. This book takes readers through an end-to-end security architecture that scales to many components in a cloud native environment, while only requiring simple security code in applications and APIs. You'll learn: Why user identity must be part of your cloud native security stack How to integrate user identity into APIs How to externalize security, secure data access, and authenticate clients using OAuth Methods for running security components in a Kubernetes cluster How to use claims to protect business data in APIs How to follow security best practices for client applications and APIs
5
Views
Registered users can read the full content for free
Register as a Gaohf Library member to read the complete e-book online for free and enjoy a better reading experience.
Page
1
Gary Archer, Judith Kahrer & Michał Trojanowski Cloud Native Data Security with OAuth A Scalable Zero Trust Architecture
Page
2
ISBN: 978-1-098-17285-5 SECURIT Y Gary Archer worked for 20 years in the financial sector as a lead developer and architect before specializing in OAuth-based security. He now shares his knowledge on securing web, mobile, and API systems at Curity. Judith Kahrer developed her passion for IT security in high school, and today she leverages her technical expertise to simplify complex topics through articles, tutorials, and webinars. Michał Trojanowski combines his background in software development with his love of teaching, specializing in API security and emerging authentication technologies like passkeys. With the growth of cloud native applications, developers increasingly rely on APIs to make everything work. But security often lags behind, making APIs an attractive target for bad actors looking to access valuable business data. OAuth, a powerful framework for API security, offers tools to protect sensitive business data and enforce dynamic access controls. But to harness its full potential, you need more than standards— you need strategies for adapting to evolving security demands. Designed for developers, architects, and security professionals, this guide provides everything you need to secure APIs in the cloud native era—ensuring your business data stays protected. You’ll learn how to combine OAuth’s token-based model with cloud native platforms like Kubernetes to build a scalable, zero trust security architecture. With OAuth, you can go beyond simple allow/deny rules and create security policies that align with business needs, while Kubernetes provides best-in-class deployment patterns to keep systems secure and efficient. • Understand why user identity must be part of your cloud native security stack • Discover how to integrate user identity into APIs • Learn to externalize security and secure data access using OAuth • Uncover methods for running security components in a Kubernetes cluster • Get the latest security best practices for client applications and APIs Cloud Native Data Security with OAuth “A comprehensive and practical guide to securing cloud native applications. This book does an excellent job of breaking down complex security topics, particularly around authentication and authorization, which are often the trickiest aspects to get right.” Mukund Sarma, senior director, product security, Chime Financial 9 7 8 1 0 9 8 1 7 2 8 5 5
Page
3
Learn more at curity.io Strong identity management capabilities combined with API access control for seamless and secure access to applications and digital services. Curity Identity Server Secure API access in cloud-native environments Update your zero-trust security architecture Realize the full benefits of OAuth API Access Security Through IAM
Page
4
Praise for Cloud Native Data Security with OAuth This book is a fantastic guide and resource to anyone looking to implement OAuth within their Cloud Native architecture. The authors have done an excellent job covering the basics but also tackling the more complex and advanced areas. They make the topic accessible and relevant to readers wanting to understand the topic in depth, and I’d highly recommend it. —Matthew Auburn, coauthor of Mastering API Architecture This book offers a comprehensive and practical guide to securing APIs in cloud-native environments. It strikes an excellent balance between theory and practice, providing clear explanations and code examples. I highly recommend this book to anyone involved in building, deploying, or securing APIs in a cloud-native context, as it equips you with the knowledge and tools needed to safeguard your applications and data in today’s dynamic and distributed systems. —Narang Dixita Sohanlal, software engineer, Google This book is a must read for anyone looking to adopt OAuth standards. The authors are subject matter experts on the topic and have provided an excellent overview combined with practical advice and examples. —Veena Rajarathna, product manager focused on API security, Kong Inc.
Page
5
(This page has no text content)
Page
6
Gary Archer, Judith Kahrer, and Michał Trojanowski Cloud Native Data Security with OAuth A Scalable Zero Trust Architecture
Page
7
978-1-098-17285-5 [LSI] Cloud Native Data Security with OAuth by Gary Archer, Judith Kahrer, and Michał Trojanowski Copyright © 2025 Curity AB. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (http://oreilly.com). For more information, contact our corporate/institu‐ tional sales department: 800-998-9938 or corporate@oreilly.com. Acquisitions Editor: Simina Calin Indexer: Judith McConville Development Editor: Virginia Wilson Interior Designer: David Futato Production Editor: Clare Laylock Cover Designer: Karen Montgomery Copyeditor: Krsta Technology Solutions Illustrator: Kate Dullea Proofreader: Vanessa Moore March 2025: First Edition Revision History for the First Edition 2025-03-06: First Release See http://oreilly.com/catalog/errata.csp?isbn=9781098164881 for release details. The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Cloud Native Data Security with OAuth, the cover image, and related trade dress are trademarks of O’Reilly Media, Inc. The views expressed in this work are those of the authors and do not represent the publisher’s views. While the publisher and the authors have used good faith efforts to ensure that the information and instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility for errors or omissions, including without limitation responsibility for damages resulting from the use of or reliance on this work. Use of the information and instructions contained in this work is at your own risk. If any code samples or other technology this work contains or describes is subject to open source licenses or the intellectual property rights of others, it is your responsibility to ensure that your use thereof complies with such licenses and/or rights. This work is part of a collaboration between O’Reilly and Curity. See our statement of editorial independence.
Page
8
Table of Contents Foreword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Part I. Introducing Cloud Native OAuth 1. Why Do You Need OAuth?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 API-First Security 4 What Is OAuth 2.0? 4 Zero Trust Security 6 APIs with Perimeter Security 6 APIs with Infrastructure Security 7 APIs with Token-Based Security 8 Zero Trust for Clients 10 Zero Trust for Users 11 API Supporting Components 12 Cloud Native Platforms 13 Summary 15 2. OAuth 2.0 Distilled. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Roles 17 The Abstract Flow 18 The Access Token 19 Client Capabilities 20 Public and Confidential Clients 21 The Code Flow 21 The Device Flow 28 v
Page
9
The Client Credentials Flow 29 The Refresh Token Flow 31 Outdated Flows 32 OpenID Connect 34 The Hybrid Flow 35 User Info 36 OAuth Evolution 38 Sessions and Lifecycle 39 The Revoke Flow 39 Terminating SSO 39 Summary 40 3. Security Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 What Is an API Security Architecture? 41 Functions in the API Security Architecture 42 Identity Management 42 API Management 43 Entitlement Management 43 The Role of the Client 44 The Role of the Access Token 44 What Security Components Do You Need? 45 The Role of the Authorization Server 47 The Role of the API Gateway 49 The Role of the Policy Engine 51 API Responsibilities 52 Client Responsibilities 53 Operating Security Components 54 Extending OAuth 56 Summary 57 4. OAuth Data Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Authorization Server Data 59 OAuth Configuration Settings 61 Designing User Accounts 63 Personal Data 63 Business User Attributes 65 API User Identities 66 Identity Operations 68 User Management APIs 69 Multiregion 71 Multitenancy 72 User Migration Code Example 74 Summary 77 vi | Table of Contents
Page
10
Part II. Securing APIs with Tokens 5. Secure API Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Unified API Security with JWT Access Tokens 81 Validating JWT Access Tokens 84 JSON Web Keys 84 Rotating Token Signing Keys 86 JWT Standard Claims 87 JWT Validation Best Practices 87 JWT Validation Code 88 API Authorization Logic 91 Use Scopes for Coarse-Grained Authorization 91 Use Claims for Fine-Grained Authorization 92 Design for Flexibility 95 Handling Token Expiry in APIs 96 Testing Zero Trust APIs 98 API Code Example 100 Summary 102 6. Access Token Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 The Access Token Contract 104 Publish the Contract 104 Version the Contract 105 Understanding Token Scope 106 OpenID Connect Scopes 108 High Privilege Scopes 109 Understanding Token Claims 110 What Constitutes a Good Claim? 112 Relation of Claims to Scopes 113 The Audience Claim 114 Data Sources for Claims 115 Obtaining the User’s Consent 118 Managing Access Tokens at Scale 120 Scaling Scopes 121 Scaling Claims 124 Designing Token Sharing 125 Token Exchange 126 Embedding Tokens in Tokens 127 API Integrations 127 Tokens for Asynchronous Communication 129 Summary 131 Table of Contents | vii
Page
11
7. Secure Access Tokens. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Secure Access Token Requirements 133 Access Token Formats 134 JWT Access Tokens 135 Encrypted JWT Access Tokens 136 Opaque Access Tokens 136 Wrapped Opaque Access Tokens 138 Access Token Delivery 139 Introspection 140 The Phantom Token Pattern 141 The Split Token Pattern 143 Hardening Access Tokens 145 Choose a JWT Signature Algorithm 145 Use Proof of Possession 146 Strengthen Browser Credentials 148 Use Least-Privilege Access Tokens 149 Limit Access Token Lifetimes 149 Plan for Token Revocation 150 Follow Secure Development Practices 152 Summary 152 8. Proxies, Gateways, and Sidecars. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 HTTP Proxies, Ingress, and Egress 154 The API Gateway Role 155 Exposing APIs in Kubernetes 156 Configure Networking 158 Deploy the API Gateway 159 Use Ingress Resource to Expose APIs 160 Use Gateway API Resources to Expose APIs 162 Choose an Extensible Gateway 164 Terminating Tokens 165 Termination of Opaque Tokens 166 Termination of Secure Cookies 167 Termination of Sender-Constrained Tokens 168 API Gateways and Zero Trust 169 The Service Mesh Role 169 API Gateway Extensibility Example 172 Create a Cluster 173 Deploy the API Gateway 174 Deploy the Authorization Server 174 Deploy the Example API 176 Run an OAuth Client 176 viii | Table of Contents
Page
12
Use the API Gateway Plug-in 177 Summary 178 9. Entitlements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Access Control Models 181 Role-Based Access Control 182 Relationship-Based Access Control 183 Attribute-Based Access Control 185 The Principle of Least Privilege 187 The Role of Token-Based Authorization 188 Benefits of an Entitlement Management System 188 Flexibility 188 Auditability 189 Security Agility 189 Quality Assurance via Policy as Code 190 Scalable Authorization 190 Policy 192 Policy Administration Point 193 Policy Retrieval Point 193 Policy Decision Point 193 Policy Enforcement Point 194 Policy Information Point 194 Open Policy Agent 195 Writing Policies in OPA 195 Loading External Data 196 Claims-Based Authorization 198 Decision Results 200 Auditing Authorization Decisions 200 Policy Retrieval in OPA 201 Example Deployment 202 Summary 206 Part III. Operating Cloud Native OAuth 10. Workload Identities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 Workload Identity Issuance 210 Implementing Request Confidentiality 213 Restricting Workload Access 215 Hardening Credentials 216 Using Platform-Issued JWTs as Credentials 217 Using X.509 SVIDs as Credentials 219 Table of Contents | ix
Page
13
Hardening Bearer Tokens 220 Limitations of Workload Identities 222 Workload Identities Code Example 223 Base Setup 224 Using Workload Identities Transparently 226 Using JWT Workload Identities 227 Using X.509 Workload Identities 228 Summary 230 11. Managing a Cloud Native Authorization Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 Hosting 232 Components 233 Clustering 234 Addressability 235 Deployment 239 Build Process 240 Environment Configuration 241 Deployment Process 243 Upgrades 245 Data Operation 247 User Account Updates 247 Configuration Updates 248 Reliability 249 High Availability 249 Fast Problem Resolution 251 Security Auditing 254 Summary 255 Part IV. Securing API Clients 12. OAuth for Native Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 The Code Flow 260 Implementing OAuth Clients 262 OAuth for Desktop Applications 262 OAuth for Mobile Applications 264 Device Secure Storage 266 Hardening Security 267 Dynamic Client Registration 268 Unique Keys Per Device 269 Application Attestation 270 Browserless User Authentication 273 x | Table of Contents
Page
14
Code Examples 275 Console Application 276 Desktop Application 277 Mobile Applications 279 Summary 281 13. OAuth for Browser-Based Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Web Application Basics 283 Website Versus Web Application 284 Web Application Architecture 284 Browser-Based Applications 286 Browser Security Threats 287 Clickjacking 287 Cross-Site Request Forgery 288 Cross-Site Scripting 289 Web Security Mechanisms 290 Same-Origin Policy 290 Content Security Policy 291 Secure Cookie Settings 293 Cross-Origin Resource Sharing 295 Implementing OAuth Using JavaScript 298 Obtaining Tokens 298 Public Clients 299 Silent Authentication 299 Refreshing Tokens 300 Token Storage 301 Implementing OAuth Using a Backend for Frontend 303 The BFF OAuth Client 304 The BFF API Router 306 API-Driven Implementations 307 The BFF API Interface 308 Web Developer Experience 310 Hardening OAuth Security 310 Using Cookies in API Requests 311 Deployment Choices 313 Scaling Deployments 314 Choosing a BFF Implementation 316 Browser-Based Application Code Example 317 OAuth Agent 317 API Gateway Routes 318 OAuth Proxy 319 Browser-Based Application 319 Summary 320 Table of Contents | xi
Page
15
14. User Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323 Modern Authentication Flows 324 User Authentication Methods 326 Passwords 327 External Identity Providers 328 One-Time Passwords 331 Passwordless Authentication 332 Identity Proofing 333 Custom User Authentication 334 User Authentication Techniques 335 Multifactor Authentication 336 Step-Up Authentication 337 Single Sign-On 337 Changing Authentication Methods 339 Account Linking 340 Authentication Actions 342 Authentication Selection 342 User Authentication Lifecycle 343 Customization of User Forms 344 User Onboarding 344 Account Recovery 346 Denying Access 347 User Decommissioning 348 Zero Trust User Authentication Example 348 Summary 350 Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 xii | Table of Contents
Page
16
Foreword Our team successfully coded an advanced OAuth and OpenID Connect server that supported the complex security standards covered in this book. In doing so, we gained deep insights into these standards and productive ways to use them. Despite our years of hard work, we quickly realized that it would be for naught if we were unable to help others understand where our product fit in the confluence of digital identity and API security. As organizations digitalize their services, they inevitably need to expose data as web services. These APIs are consumed by mobile apps, single-page applications, and tra‐ ditional websites. In effect, this makes those APIs platforms for new digital processes, business models, and experiences. This metamorphosis to digital natives requires organizations to authenticate users and authorize access to data APIs. These are diffi‐ cult problems that the OAuth and OpenID Connect specifications were designed to help solve. It is paramount that those seeking to adopt digital business also embrace and deploy these standards. To explain how to do so, we needed to add to our team people that had not only mas‐ tered these technologies but also had an ability to teach them to others. Those people had to be skilled communicators, engaging instructors, and fluent writers. We found these qualities in Gary, Judith, and Michał and were immediately fond of their desires to uplift the industry through knowledge sharing. All three of them have a passion to teach complex topics and articulate the value behind them in ways that normal soft‐ ware teams can understand. As we worked together, the new team frequently used cloud native technologies to demonstrate OAuth standards and back up the theory. We realized that there was another convergence of technologies that needed to be taught. The team’s learning resources explained how digital identity and APIs were coupled while also showing how these technologies could be used in cloud computing as native components. By protecting data exposed in meshes of microservices, repeatable patterns emerged from xiii
Page
17
their work that spanned use cases and industries. As we learned new techniques from them, we understood that this critical knowledge also needed to be disseminated. When the authors proposed writing a book on these topics as a part of their day jobs, we agreed without hesitation because Curity’s mission is to play a part in making the internet safer by, among other things, spreading knowledge on identity topics. Because of our roles at Curity, we had the unique opportunity to read each chapter as the authors wrote them. With each, we appreciated their advocation of design pat‐ terns, adherence to best practices, and clear communication of protocols devoid of product-related promotions. With the knowledge they captured in the chapters you’re about to read, the authors not only explain how digital identity and API security intersect but also how to deploy solutions to such problems in cloud-native environments. If you haven’t per‐ formed such deployments before, this book should help you to understand the approach and how to deal with multiple components and endpoints, to help you ensure that your installations are secure, modern, and easy to operate. The book uses both OAuth and cloud native in a technology-neutral and vendor- neutral manner. The tools and techniques remain relevant even if you do not operate in a cloud native environment. Ultimately, it is about serving APIs in the best ways, which in turn serves your business and users. In many organizations, you need to consider regulatory restrictions, multicloud strategies and migrations from legacy identity infrastructure to enable OAuth. Cloud native can help you with these goals. As the authors will show you, integrating OAuth and cloud native is not as hard as you may think and comes with many benefits. With this said, we recommend this book to you, and leave you now in the hands of the authors. — Travis Spencer and Jacob Ideskog, Cofounders of Curity xiv | Foreword
Page
18
Preface When you build digital solutions, your users run applications that access data over the internet. These applications can run on browsers, mobile devices, servers, or any other platform. They have one thing in common, though: they are API clients, and that means they call APIs to access data. APIs must enable secure data access because the data they serve may include intellectual property, personal data belonging to citi‐ zens or users, or information belonging to business partners. To protect data and access to it, you must secure both APIs and the application fetching the data. Such security requirements can originate from compliance and regulatory initiatives. One example is the European Union’s General Data Protection Regulation (GDPR), which governs user privacy and consent. Managing data security and privacy in APIs and API clients is a difficult problem that requires an architectural solution. Your APIs must process user identities correctly so that each user gains access to only the correct API resources. To achieve that, you must apply business authorization in APIs. The exact authorization rules depend, of course, on your business use cases. Ideally, you ensure that every API request from a client includes an unforgeable and least-privilege API message credential. This cre‐ dential conveys business permissions. You first verify such a credential in the API before you enforce your particular rules. When you protect every API request in this manner, for both external and internal requests, you get a zero trust API architecture. When implementing API security, we assume you want certain architectural quali‐ ties, including reliability, scalability, and a productive developer experience. Your architecture should enable you to meet all of these nonfunctional requirements in addition to security. We show you how to achieve such an architecture using solid design choices. We demonstrate a separation of concerns approach to externalize dif‐ ficult areas from your application code. For example, you can host security compo‐ nents on a cloud native platform with modern clustering and elasticity features to meet your high-availability requirements. Similarly, you can manage cryptography and other security plumbing using specialist endpoints and libraries. Your choices should enable a future-proof setup and scale to many applications, APIs, and teams. xv
Page
19
Why We Wrote This Book We (the authors) all work at Curity, a company specialized in identity and access management for APIs. In our day-to-day jobs, we teach OAuth and related technolo‐ gies to a wide audience. We base some of our online material on the Curity Identity Server, yet the majority of our content is not product-specific and explains a standards-based architecture. Our work involves presentations, videos, online arti‐ cles, and code examples as well as investigations and explorations in the space of secure authentication and API access. Although cloud native is the state of the art when it comes to deploying APIs, we noticed that resources on cloud native security mainly focus on the infrastructure. We acknowledge that infrastructure security, such as encryption, is important to secure data, and so are processes, policies, and gover‐ nance. Authorization is the piece of the puzzle that we happen to be experts in. We wrote this book because we believe that OAuth has major architectural benefits for applications and APIs, yet it is widely misunderstood. This prevents organizations from making the right choices and fully realizing the benefits. In particular, we believe that access tokens are often used suboptimally. When you design access tokens correctly, they enable you to set security boundaries and control authorization to your secured business resources in a way that benefits all kinds of organizations— from small to very large. By combining a centralized token issuer with smart authori‐ zation techniques, you can monitor, audit, and govern resource access at any scale. We explain the main security requirements for APIs and API clients with regard to authorization and show how OAuth helps you to meet them. Part II is the core of the book and we recommend that you take special care when reading it. We think that if we can help you to understand how identity and business components work together, you will be able to make the right choices and fully benefit from OAuth for a secure and scalable solution. We explain a sequential journey from the viewpoint of devel‐ opers and organizations building digital solutions. We provide theoretical content along with practical content to back up the theory. Who This Book Is For The content is aimed at any developer, architect, or site reliability engineer interested in API security. You may work with APIs that already have some basic security but want to learn how to update to a zero trust architecture. Preferably, you have an intermediate-level knowledge of APIs and API security. We use Docker and Kubernetes to provide examples that implement our security designs. Thus, if you are familiar with containers, you will get a more hands-on expe‐ rience from the book. However, you can apply the concepts we describe to any cloud native platform. xvi | Preface
Page
20
The book is detailed in places, so you should be prepared to absorb a considerable amount of content on identity topics. Above all, you should be willing to adopt a separation-of-concerns approach to software engineering. What You Will Learn You will learn how to secure APIs and clients using the OAuth 2.0 authorization framework. We will present designs, patterns, and best practices that help you to enforce business permissions in APIs. You will learn how to perform the following tasks: • Design least-privilege access tokens. • Operate an authorization server. • Issue access tokens to API clients, then send them to APIs. • Validate access tokens in APIs, then authorize access to business data. • Implement a code flow in clients, to enable many ways to authenticate. • Manage token confidentiality for internet clients. • Follow best practices for browser-based applications, to limit damage if there is a cross-site scripting (XSS) exploit. • Implement OAuth 2.0 for platform-specific applications, to secure both desktop and mobile applications. • Manage client-specific security differences in an API gateway. • Combine OAuth 2.0 with infrastructure security. • Keep application code portable and standards-based. • Deal with error conditions and ensure reliable end-to-end flows. Cloud Native Environments We decided to set this book in a cloud native environment because we believe that such an environment provides the optimal features for managing secured APIs. Cloud native technologies empower organizations to build and run scalable applica‐ tions in modern, dynamic environments such as public, private, and hybrid clouds. Containers, service meshes, microservices, immutable infrastructure, and declarative APIs exemplify this approach. —CNCF Cloud Native Definition v1.0 In the context of this book, the relevant technologies for the security architecture, as well as the code examples, are containers, services meshes, and microservices. We do not make any assumptions about whether you run a public, private, or hybrid cloud. Preface | xvii
The above is a preview of the first 20 pages. Register to read the complete e-book.
AI Reading Assistant
Whole-book reading guide from stratified index samples; jump to passages in the text
AI guide
【One-Line Pitch】
A practical architecture guide for teams building cloud native APIs that need real data protection, not just login: it shows how to combine OAuth 2.0, token claims, and Kubernetes-hosted security components into a scalable zero-trust design. Best for backend, API, and platform engineers who already know Kubernetes basics and want security patterns they can actually implement.
【Book Arc】
- **Opening (~0%–10%)**: Sets up the core problem—APIs are the new attack surface, and weak internal patterns (shared API keys, plain user-ID headers) fail under zero trust—then previews the reference architecture and the browser/client threat landscape.
- **Early (~10%–35%)**: Distills OAuth 2.0 essentials: the three token types, client capabilities, public vs. confidential clients, the code flow with PKCE, and why legacy flows like implicit should be retired. This is the vocabulary layer for everything later.
- **Middle (~35%–55%)**: Introduces the component architecture—authorization server, API gateway, policy engine, APIs—and assigns responsibilities to each party, including client obligations for token handling and the authorization server's configuration, key, and identity data.
- **Late (~55%–85%)**: Moves into token design and claims as the mechanism for protecting business data in APIs, plus operational concerns like running security components reliably in a Kubernetes cluster (excerpts do not detail these chapters).
- **Ending (~85%–100%)**: Applies the model to concrete client types—console, desktop, mobile, and browser-based applications—covering BFF vs. JavaScript OAuth clients and web security mechanisms like CSP, CORS, and secure cookies.
【Book Arc】(continued)
- **Practice thread throughout**: Code examples in a GitHub repository accompany the theory, deliberately complex because they mirror a distributed architecture; the authors frame them as optional but useful for comparison.
【Key Takeaways】
- **OAuth alone is not a data-security strategy** (Opening): the standard governs token issuance, not how APIs should use tokens to protect business data—that design work is on you, and skipping it invites breaches.
- **Treat access tokens as opaque on the client** (Early): clients should never parse token contents or build logic on claims; doing so leaks sensitive data and breaks when the authorization server changes token format. APIs, not clients, interpret scopes and claims.
- **Use the code flow with PKCE; drop the implicit flow** (Early): PKCE binds the authorization code to the session and mitigates code interception and injection attacks, and modern browsers no longer justify implicit.
- **Externalize security into dedicated components** (Middle): a cloud native authorization server is the minimum addition; an API gateway can enforce coarse-grained checks early, and a policy engine can be added later. Applications and APIs then need only simple security code.
- **Every component must trust the authorization server** (Middle): clients, gateway, APIs, and policy engine all need to fetch keys or validate tokens—and API SLAs should account for the authorization server's SLA, since token issuance failures become business interruptions.
- **Least privilege is enforced through scopes and claims** (Early/Middle): grant the bare minimum, verify scope and claim values in APIs, and let claims drive both authorization decisions and which data is returned.
- **Client-side token hygiene is non-negotiable** (Middle): HTTPS everywhere with certificate validation, tokens never in URLs, secure storage at rest, and revocation on logout.
- **Browser clients need layered defenses** (Ending): same-origin policy, CSP, secure cookie settings, and CORS complement OAuth; the BFF pattern is presented as the safer alternative to pure JavaScript clients for token handling.
【Reading Tips】
- If you already know OAuth, skim the early distillation chapters for the authors' opinions (opaque tokens, PKCE, retiring implicit) and slow down at the architecture and claims chapters—that's where the book's distinctive value sits.
- Read the "What This Book Is Not" preface carefully: it explicitly excludes Kubernetes fundamentals, deep cryptography, and OS/container/database hardening, so calibrate expectations and fill gaps elsewhere.
- Treat the code examples as a reference implementation, not a tutorial; study the READMEs alongside the relevant chapter rather than reading code linearly.
- Deep-read the client-type chapters (browser, mobile, desktop) matching your actual deployment targets; skim the others for pattern comparison.
- Take away one artifact: a diagram of your own system mapped onto the book's component responsibilities (client, gateway, authorization server, policy engine, APIs).
【Coverage Limits】
The excerpts cover the preface, table of contents, and early-to-middle chapters on OAuth fundamentals and architecture; the token-design, Kubernetes operations, and client-specific chapters are only partially represented, so this guide's late-stage claims are inferred from chapter titles and summaries rather than full text.
Passage locations
Page 8
. . . . . . . . . . . . . . . . . . . . . . . . . . . . xv Part I. Introducing Cloud Native OAuth 1. Why Do You Need OAuth?. . . . . . . . . . . . . . . . ....
View in text
Excerpt 2
book’s theory with code examples that you can download from the book’s GitHub repository. Using code examples is entirely optional but may be useful if you w...
View in text
Excerpt 3
ethod in the authorization request. Example 2-6 illustrates an authorization request with PKCE that includes both a hash in the code_challenge and the hash m...
View in text
Excerpt 4
ion server Your configuration data includes client settings. You typically must register clients at the authorization server before they can receive tokens....
View in text
Recommended for You
{{#thumbnailUrl}}
{{/thumbnailUrl}}
{{^thumbnailUrl}}
{{/thumbnailUrl}}
Loading recommended books...
Failed to load, please try again later
Tip the Site
Scan the WeChat Pay or Alipay code to tip. No login required.
WeChat Pay
Alipay