SlideShare a Scribd company logo
Deploy and Secure
Your API Gateway
with NGINX
FROM ZERO TO HERO
Scott van Kalken
Solution Architect
November 17, 2021
| ©2021 F5 | NGINX SPRINT APAC 2.1
2
Scott van Kalken
Everyone just calls me svk (it’s easier)
Interested in devops and application testing.
Super passionate about open source (not just
software, but data too)
I have the privilege of helping run a few
meetups.
| ©2021 F5
3
• What is a (REST) API?
• API essentials – what do users and owners want?
• What are API Gateways and how do they help deliver mission-critical digital
experiences?
• Deploying NGINX as an API Gateway
• Securing an API Gateway using NGINX App Protect WAF
Table of contents
| ©2021 F5
4
What is a (REST) API?
| ©2021 F5
6
Developers provide dedicated URLs that are optimized to
return pure data to requesting clients
Web client à Web server à Request returns HTML
API client à API Endpoint à Request returns data
API endpoint
EASY TO CONSUME DATA
| ©2021 F5
7
Components of an API request
a) API endpoint (URL)
b) API method
c) Request body (if sending a POST/PUT request)
d) API client -> curl, postman, client application, etc…
| ©2021 F5
10
Anatomy of an API call
API Client Internet API(s)
| ©2021 F5
11
$ curl -s -X GET https://pokeapi.co/api/v2/pokemon/ditto | jq '.types'
[
{
"slot": 1,
"type": {
"name": "normal",
"url": "https://pokeapi.co/api/v2/type/1/"
}
}
]
| ©2021 F5
12
$ curl -sI https://pokeapi.co/api/v2/pokemon/ditto
HTTP/2 200
date: Wed, 06 Oct 2021 16:06:01 GMT
content-type: application/json; charset=utf-8
| ©2021 F5
13
API Essentials
What do users and owners want
| ©2021 F5
14
APIS ARE EXPERIENCING EXPLOSIVE GROWTH
The rise of APIs
| ©2021 F5
15
Drivers for API Adoption
Ease access to
information
• Break down siloes and
unlock data (within and
among organizations)
• Increase collaboration
amongst developers
Create new digital
revenue streams
• New opportunities to
generate revenue
• Build partnerships with
third-party developers
and business ecosystem
Connect
microservices
• Primary interface for
communication amongst
microservices
| ©2021 F5
18
API essentials
USERS / CONSUMER
Documentation
Ease of use Low latency Security
| ©2021 F5
19
Developer
productivity
Revenue
growth
API essentials
OWNERS
Customer
experience
Brand
protection
| ©2021 F5
20
API Gateways
How do they help deliver mission-critical digital experiences
| ©2021 F5
21
AUTHENTICATION
REQUEST ROUTING
TRAFFIC CONTROL
EXCEPTION HANDLING
| ©2021 F5
22
Anatomy of an API call
API Client
Internet /
WAN
API
Gateway
API(s)
| ©2021 F5
23
API gateway essentials
CONTROL ACCESS TO YOUR APIS
• Centralized logging
• Client authentication
• Fine grained access control
• Load balancing
• Rate limiting
• Request routing
• Request/response manipulation
• Service discovery of backends
• TLS termination
| ©2021 F5
24
PERFORMANCE IS KEY
API gateway essentials
30 ms ... to process
an API request
end-to-end
... to route, shape,
authenticate, secure,
and cache an API
@p99
(latency)
| ©2021 F5
25
NGINX Plus
as an API Gateway
| ©2021 F5
27
30%
Source: NGINX User Survey 2020
of NGINX deployments
are as an API Gateway
| ©2021 F5
28
ACCESS YOUR APIS IN LESS THAN 30MS EVEN WHEN USING AN API GATEWAY
What makes NGINX API Gateways special?
| ©2021 F5
30
+
| ©2021 F5
31
NGINX API gateway
KEY STRENGTHS
High performance
for real-time APIs
DevOps friendly Platform flexibility Distributed environments
| ©2021 F5
32
Authentication options
API
gateway
HTTP
basic
Client
cert
JWT
(NGINX Plus)
API key
| ©2021 F5
33
API Security
| ©2021 F5
35
• “The continuous growth in open source
usage”
• “A substantial increase in security
research, resulting in a rise in the
number of reported security issues
including a high number of API
vulnerabilities”
• “The growing popularity of containerized
environments, which suffer from a high
volume of code and configuration issues”
FORRESTER’S STATE OF APPLICATION SECURITY REPORT 2021
Bridging the Gap Between
Security and Dev
Source:
https://www.whitesourcesoftware.com/resources/blog/forre
sters-state-of-application-security-2021-key-takeaways/
| ©2021 F5
37
+
Demo Time
| ©2021 F5
60
In conclusion…
| ©2021 F5
61
=
Step 1 – api’s
Step 2 – custom error messages
Step 3 – add URI request routing
Step 4 – add rate limiting
Step 8 – Web Application Firewall
Step 5 – static API key
Step 6 - JWT
Step 7 - Input validation
| ©2021 F5
62
Resources
FIND OUT MORE!
https://www.nginx.com/resources/library/nginx-api-gateway-deployment https://www.nginx.com/blog/deploying-nginx-plus-as-an-api-gateway-part-1/
| ©2021 F5
63
DEPLOY AND SECURE YOUR API GATEWAY WITH NGINX’S FREE TRIAL -> HTTPS://WWW.NGINX.COM/FREE-TRIAL-REQUEST/
Check out NGINX Plus and NGINX App Protect!
| ©2021 F5
64
Q&A
Deploy and Secure Your API Gateway with NGINX: From Zero to Hero – APCJ

More Related Content

What's hot

Microservice Architecture
Microservice ArchitectureMicroservice Architecture
Microservice Architecture
Nguyen Tung
 
API Security Fundamentals
API Security FundamentalsAPI Security Fundamentals
API Security Fundamentals
José Haro Peralta
 
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
Elastic  Load Balancing Deep Dive - AWS Online Tech TalkElastic  Load Balancing Deep Dive - AWS Online Tech Talk
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
Amazon Web Services
 
Introduction to Event Driven Architecture
Introduction to Event Driven ArchitectureIntroduction to Event Driven Architecture
Introduction to Event Driven Architecture
CitiusTech
 
Fido Technical Overview
Fido Technical OverviewFido Technical Overview
Fido Technical Overview
FIDO Alliance
 
Microservice Architecture Patterns, by Richard Langlois P. Eng.
Microservice Architecture Patterns, by Richard Langlois P. Eng.Microservice Architecture Patterns, by Richard Langlois P. Eng.
Microservice Architecture Patterns, by Richard Langlois P. Eng.
Richard Langlois P. Eng.
 
Axon Framework, Exploring CQRS and Event Sourcing Architecture
Axon Framework, Exploring CQRS and Event Sourcing ArchitectureAxon Framework, Exploring CQRS and Event Sourcing Architecture
Axon Framework, Exploring CQRS and Event Sourcing Architecture
Ashutosh Jadhav
 
Introduction to Microservices
Introduction to MicroservicesIntroduction to Microservices
Introduction to Microservices
MahmoudZidan41
 
API Gateway report
API Gateway reportAPI Gateway report
API Gateway report
Gleicon Moraes
 
OWASP API Security Top 10 - API World
OWASP API Security Top 10 - API WorldOWASP API Security Top 10 - API World
OWASP API Security Top 10 - API World
42Crunch
 
Introduction to FIDO: A New Model for Authentication
Introduction to FIDO: A New Model for AuthenticationIntroduction to FIDO: A New Model for Authentication
Introduction to FIDO: A New Model for Authentication
FIDO Alliance
 
Micro services Architecture
Micro services ArchitectureMicro services Architecture
Micro services Architecture
Araf Karsh Hamid
 
Api gateway
Api gatewayApi gateway
Api gateway
enyert
 
Serverless Summit - Quiz
Serverless Summit - QuizServerless Summit - Quiz
Serverless Summit - Quiz
CodeOps Technologies LLP
 
What is an API Gateway?
What is an API Gateway?What is an API Gateway?
What is an API Gateway?
LunchBadger
 
Android Pentesting
Android PentestingAndroid Pentesting
Introduction to Microservices
Introduction to MicroservicesIntroduction to Microservices
Introduction to Microservices
Amazon Web Services
 
Event-driven microservices
Event-driven microservicesEvent-driven microservices
Event-driven microservices
Andrew Schofield
 
Static Application Security Testing Strategies for Automation and Continuous ...
Static Application Security Testing Strategies for Automation and Continuous ...Static Application Security Testing Strategies for Automation and Continuous ...
Static Application Security Testing Strategies for Automation and Continuous ...
Kevin Fealey
 
Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...
Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...
Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...
VMware Tanzu
 

What's hot (20)

Microservice Architecture
Microservice ArchitectureMicroservice Architecture
Microservice Architecture
 
API Security Fundamentals
API Security FundamentalsAPI Security Fundamentals
API Security Fundamentals
 
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
Elastic  Load Balancing Deep Dive - AWS Online Tech TalkElastic  Load Balancing Deep Dive - AWS Online Tech Talk
Elastic Load Balancing Deep Dive - AWS Online Tech Talk
 
Introduction to Event Driven Architecture
Introduction to Event Driven ArchitectureIntroduction to Event Driven Architecture
Introduction to Event Driven Architecture
 
Fido Technical Overview
Fido Technical OverviewFido Technical Overview
Fido Technical Overview
 
Microservice Architecture Patterns, by Richard Langlois P. Eng.
Microservice Architecture Patterns, by Richard Langlois P. Eng.Microservice Architecture Patterns, by Richard Langlois P. Eng.
Microservice Architecture Patterns, by Richard Langlois P. Eng.
 
Axon Framework, Exploring CQRS and Event Sourcing Architecture
Axon Framework, Exploring CQRS and Event Sourcing ArchitectureAxon Framework, Exploring CQRS and Event Sourcing Architecture
Axon Framework, Exploring CQRS and Event Sourcing Architecture
 
Introduction to Microservices
Introduction to MicroservicesIntroduction to Microservices
Introduction to Microservices
 
API Gateway report
API Gateway reportAPI Gateway report
API Gateway report
 
OWASP API Security Top 10 - API World
OWASP API Security Top 10 - API WorldOWASP API Security Top 10 - API World
OWASP API Security Top 10 - API World
 
Introduction to FIDO: A New Model for Authentication
Introduction to FIDO: A New Model for AuthenticationIntroduction to FIDO: A New Model for Authentication
Introduction to FIDO: A New Model for Authentication
 
Micro services Architecture
Micro services ArchitectureMicro services Architecture
Micro services Architecture
 
Api gateway
Api gatewayApi gateway
Api gateway
 
Serverless Summit - Quiz
Serverless Summit - QuizServerless Summit - Quiz
Serverless Summit - Quiz
 
What is an API Gateway?
What is an API Gateway?What is an API Gateway?
What is an API Gateway?
 
Android Pentesting
Android PentestingAndroid Pentesting
Android Pentesting
 
Introduction to Microservices
Introduction to MicroservicesIntroduction to Microservices
Introduction to Microservices
 
Event-driven microservices
Event-driven microservicesEvent-driven microservices
Event-driven microservices
 
Static Application Security Testing Strategies for Automation and Continuous ...
Static Application Security Testing Strategies for Automation and Continuous ...Static Application Security Testing Strategies for Automation and Continuous ...
Static Application Security Testing Strategies for Automation and Continuous ...
 
Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...
Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...
Winning the Lottery with Spring: A Microservices Case Study for the Dutch Lot...
 

Similar to Deploy and Secure Your API Gateway with NGINX: From Zero to Hero – APCJ

Deploy and Secure Your API Gateway with NGINX: From Zero to Hero
Deploy and Secure Your API Gateway with NGINX: From Zero to HeroDeploy and Secure Your API Gateway with NGINX: From Zero to Hero
Deploy and Secure Your API Gateway with NGINX: From Zero to Hero
NGINX, Inc.
 
Securing Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the CloudSecuring Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the Cloud
Olivia LaMar
 
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAPSecuring Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Olivia LaMar
 
Relevez les défis Kubernetes avec NGINX
Relevez les défis Kubernetes avec NGINXRelevez les défis Kubernetes avec NGINX
Relevez les défis Kubernetes avec NGINX
NGINX, Inc.
 
Get the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINXGet the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINX
NGINX, Inc.
 
The Current And Future State Of Service Mesh
The Current And Future State Of Service MeshThe Current And Future State Of Service Mesh
The Current And Future State Of Service Mesh
Ram Vennam
 
Kubernetes Networking
Kubernetes NetworkingKubernetes Networking
Kubernetes Networking
NGINX, Inc.
 
EVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQL
EVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQLEVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQL
EVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQL
juliebardinjimenez1
 
Successfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINXSuccessfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINX
NGINX, Inc.
 
apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...
apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...
apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...
apidays
 
Deploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native KubernetesDeploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native Kubernetes
Kangaroot
 
nginxcontrollerapimanagementwebinar-190123215258.pdf
nginxcontrollerapimanagementwebinar-190123215258.pdfnginxcontrollerapimanagementwebinar-190123215258.pdf
nginxcontrollerapimanagementwebinar-190123215258.pdf
Andri Wahyudi
 
Nim tames sprawl
Nim tames sprawlNim tames sprawl
Nim tames sprawl
NGINX, Inc.
 
Achieve Full API Lifecycle Management Using NGINX Controller
Achieve Full API Lifecycle Management Using NGINX ControllerAchieve Full API Lifecycle Management Using NGINX Controller
Achieve Full API Lifecycle Management Using NGINX Controller
NGINX, Inc.
 
The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0
The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0
The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0
WSO2
 
What's New with NGINX Application Security Solutions
What's New with NGINX Application Security SolutionsWhat's New with NGINX Application Security Solutions
What's New with NGINX Application Security Solutions
NGINX, Inc.
 
F5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-CloudF5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-Cloud
abenyeung1
 
Agile integration activation: get hands on with ap-is
Agile integration activation: get hands on with ap-isAgile integration activation: get hands on with ap-is
Agile integration activation: get hands on with ap-is
Judy Breedlove
 
The 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdfThe 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdf
Cisco DevNet
 
Migrating from IBM API Connect v5 to v2018
Migrating from IBM API Connect v5 to v2018Migrating from IBM API Connect v5 to v2018
Migrating from IBM API Connect v5 to v2018
Natalia Kataoka
 

Similar to Deploy and Secure Your API Gateway with NGINX: From Zero to Hero – APCJ (20)

Deploy and Secure Your API Gateway with NGINX: From Zero to Hero
Deploy and Secure Your API Gateway with NGINX: From Zero to HeroDeploy and Secure Your API Gateway with NGINX: From Zero to Hero
Deploy and Secure Your API Gateway with NGINX: From Zero to Hero
 
Securing Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the CloudSecuring Your Apps & APIs in the Cloud
Securing Your Apps & APIs in the Cloud
 
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAPSecuring Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
Securing Kubernetes Clusters with NGINX Plus Ingress Controller & NAP
 
Relevez les défis Kubernetes avec NGINX
Relevez les défis Kubernetes avec NGINXRelevez les défis Kubernetes avec NGINX
Relevez les défis Kubernetes avec NGINX
 
Get the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINXGet the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINX
 
The Current And Future State Of Service Mesh
The Current And Future State Of Service MeshThe Current And Future State Of Service Mesh
The Current And Future State Of Service Mesh
 
Kubernetes Networking
Kubernetes NetworkingKubernetes Networking
Kubernetes Networking
 
EVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQL
EVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQLEVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQL
EVERYTHING AS CODE: API-GATEWAY, DEVELOPER PORTAL UND GRAPHQL
 
Successfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINXSuccessfully Implement Your API Strategy with NGINX
Successfully Implement Your API Strategy with NGINX
 
apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...
apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...
apidays Helsinki & North 2023 - The future of API Management, Jona Apelbaum &...
 
Deploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native KubernetesDeploying NGINX in Cloud Native Kubernetes
Deploying NGINX in Cloud Native Kubernetes
 
nginxcontrollerapimanagementwebinar-190123215258.pdf
nginxcontrollerapimanagementwebinar-190123215258.pdfnginxcontrollerapimanagementwebinar-190123215258.pdf
nginxcontrollerapimanagementwebinar-190123215258.pdf
 
Nim tames sprawl
Nim tames sprawlNim tames sprawl
Nim tames sprawl
 
Achieve Full API Lifecycle Management Using NGINX Controller
Achieve Full API Lifecycle Management Using NGINX ControllerAchieve Full API Lifecycle Management Using NGINX Controller
Achieve Full API Lifecycle Management Using NGINX Controller
 
The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0
The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0
The Best of Both Worlds: Introducing WSO2 API Manager 4.0.0
 
What's New with NGINX Application Security Solutions
What's New with NGINX Application Security SolutionsWhat's New with NGINX Application Security Solutions
What's New with NGINX Application Security Solutions
 
F5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-CloudF5 and HashiCorp Multi-Cloud
F5 and HashiCorp Multi-Cloud
 
Agile integration activation: get hands on with ap-is
Agile integration activation: get hands on with ap-isAgile integration activation: get hands on with ap-is
Agile integration activation: get hands on with ap-is
 
The 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdfThe 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdf
 
Migrating from IBM API Connect v5 to v2018
Migrating from IBM API Connect v5 to v2018Migrating from IBM API Connect v5 to v2018
Migrating from IBM API Connect v5 to v2018
 

More from NGINX, Inc.

【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法
【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法
【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法
NGINX, Inc.
 
【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー
【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー
【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー
NGINX, Inc.
 
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
NGINX, Inc.
 
Get Hands-On with NGINX and QUIC+HTTP/3
Get Hands-On with NGINX and QUIC+HTTP/3Get Hands-On with NGINX and QUIC+HTTP/3
Get Hands-On with NGINX and QUIC+HTTP/3
NGINX, Inc.
 
Managing Kubernetes Cost and Performance with NGINX & Kubecost
Managing Kubernetes Cost and Performance with NGINX & KubecostManaging Kubernetes Cost and Performance with NGINX & Kubecost
Managing Kubernetes Cost and Performance with NGINX & Kubecost
NGINX, Inc.
 
Manage Microservices Chaos and Complexity with Observability
Manage Microservices Chaos and Complexity with ObservabilityManage Microservices Chaos and Complexity with Observability
Manage Microservices Chaos and Complexity with Observability
NGINX, Inc.
 
Accelerate Microservices Deployments with Automation
Accelerate Microservices Deployments with AutomationAccelerate Microservices Deployments with Automation
Accelerate Microservices Deployments with Automation
NGINX, Inc.
 
Unit 2: Microservices Secrets Management 101
Unit 2: Microservices Secrets Management 101Unit 2: Microservices Secrets Management 101
Unit 2: Microservices Secrets Management 101
NGINX, Inc.
 
Unit 1: Apply the Twelve-Factor App to Microservices Architectures
Unit 1: Apply the Twelve-Factor App to Microservices ArchitecturesUnit 1: Apply the Twelve-Factor App to Microservices Architectures
Unit 1: Apply the Twelve-Factor App to Microservices Architectures
NGINX, Inc.
 
NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!
NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!
NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!
NGINX, Inc.
 
Easily View, Manage, and Scale Your App Security with F5 NGINX
Easily View, Manage, and Scale Your App Security with F5 NGINXEasily View, Manage, and Scale Your App Security with F5 NGINX
Easily View, Manage, and Scale Your App Security with F5 NGINX
NGINX, Inc.
 
NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!
NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!
NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!
NGINX, Inc.
 
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINXKeep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
NGINX, Inc.
 
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
NGINX, Inc.
 
Protecting Apps from Hacks in Kubernetes with NGINX
Protecting Apps from Hacks in Kubernetes with NGINXProtecting Apps from Hacks in Kubernetes with NGINX
Protecting Apps from Hacks in Kubernetes with NGINX
NGINX, Inc.
 
NGINX Kubernetes API
NGINX Kubernetes APINGINX Kubernetes API
NGINX Kubernetes API
NGINX, Inc.
 
Installing and Configuring NGINX Open Source
Installing and Configuring NGINX Open SourceInstalling and Configuring NGINX Open Source
Installing and Configuring NGINX Open Source
NGINX, Inc.
 
Shift Left for More Secure Apps with F5 NGINX
Shift Left for More Secure Apps with F5 NGINXShift Left for More Secure Apps with F5 NGINX
Shift Left for More Secure Apps with F5 NGINX
NGINX, Inc.
 
How to Avoid the Top 5 NGINX Configuration Mistakes.pptx
How to Avoid the Top 5 NGINX Configuration Mistakes.pptxHow to Avoid the Top 5 NGINX Configuration Mistakes.pptx
How to Avoid the Top 5 NGINX Configuration Mistakes.pptx
NGINX, Inc.
 
Kubernetes環境で実現するWebアプリケーションセキュリティ
Kubernetes環境で実現するWebアプリケーションセキュリティKubernetes環境で実現するWebアプリケーションセキュリティ
Kubernetes環境で実現するWebアプリケーションセキュリティ
NGINX, Inc.
 

More from NGINX, Inc. (20)

【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法
【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法
【NGINXセミナー】 Ingressを使ってマイクロサービスの運用を楽にする方法
 
【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー
【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー
【NGINXセミナー】 NGINXのWAFとは?その使い方と設定方法 解説セミナー
 
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
【NGINXセミナー】API ゲートウェイとしてのNGINX Plus活用方法
 
Get Hands-On with NGINX and QUIC+HTTP/3
Get Hands-On with NGINX and QUIC+HTTP/3Get Hands-On with NGINX and QUIC+HTTP/3
Get Hands-On with NGINX and QUIC+HTTP/3
 
Managing Kubernetes Cost and Performance with NGINX & Kubecost
Managing Kubernetes Cost and Performance with NGINX & KubecostManaging Kubernetes Cost and Performance with NGINX & Kubecost
Managing Kubernetes Cost and Performance with NGINX & Kubecost
 
Manage Microservices Chaos and Complexity with Observability
Manage Microservices Chaos and Complexity with ObservabilityManage Microservices Chaos and Complexity with Observability
Manage Microservices Chaos and Complexity with Observability
 
Accelerate Microservices Deployments with Automation
Accelerate Microservices Deployments with AutomationAccelerate Microservices Deployments with Automation
Accelerate Microservices Deployments with Automation
 
Unit 2: Microservices Secrets Management 101
Unit 2: Microservices Secrets Management 101Unit 2: Microservices Secrets Management 101
Unit 2: Microservices Secrets Management 101
 
Unit 1: Apply the Twelve-Factor App to Microservices Architectures
Unit 1: Apply the Twelve-Factor App to Microservices ArchitecturesUnit 1: Apply the Twelve-Factor App to Microservices Architectures
Unit 1: Apply the Twelve-Factor App to Microservices Architectures
 
NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!
NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!
NGINX基本セミナー(セキュリティ編)~NGINXでセキュアなプラットフォームを実現する方法!
 
Easily View, Manage, and Scale Your App Security with F5 NGINX
Easily View, Manage, and Scale Your App Security with F5 NGINXEasily View, Manage, and Scale Your App Security with F5 NGINX
Easily View, Manage, and Scale Your App Security with F5 NGINX
 
NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!
NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!
NGINXセミナー(基本編)~いまさら聞けないNGINXコンフィグなど基本がわかる!
 
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINXKeep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
Keep Ahead of Evolving Cyberattacks with OPSWAT and F5 NGINX
 
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
Install and Configure NGINX Unit, the Universal Application, Web, and Proxy S...
 
Protecting Apps from Hacks in Kubernetes with NGINX
Protecting Apps from Hacks in Kubernetes with NGINXProtecting Apps from Hacks in Kubernetes with NGINX
Protecting Apps from Hacks in Kubernetes with NGINX
 
NGINX Kubernetes API
NGINX Kubernetes APINGINX Kubernetes API
NGINX Kubernetes API
 
Installing and Configuring NGINX Open Source
Installing and Configuring NGINX Open SourceInstalling and Configuring NGINX Open Source
Installing and Configuring NGINX Open Source
 
Shift Left for More Secure Apps with F5 NGINX
Shift Left for More Secure Apps with F5 NGINXShift Left for More Secure Apps with F5 NGINX
Shift Left for More Secure Apps with F5 NGINX
 
How to Avoid the Top 5 NGINX Configuration Mistakes.pptx
How to Avoid the Top 5 NGINX Configuration Mistakes.pptxHow to Avoid the Top 5 NGINX Configuration Mistakes.pptx
How to Avoid the Top 5 NGINX Configuration Mistakes.pptx
 
Kubernetes環境で実現するWebアプリケーションセキュリティ
Kubernetes環境で実現するWebアプリケーションセキュリティKubernetes環境で実現するWebアプリケーションセキュリティ
Kubernetes環境で実現するWebアプリケーションセキュリティ
 

Recently uploaded

Enhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdf
Enhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdfEnhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdf
Enhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdf
Jay Das
 
2024 RoOUG Security model for the cloud.pptx
2024 RoOUG Security model for the cloud.pptx2024 RoOUG Security model for the cloud.pptx
2024 RoOUG Security model for the cloud.pptx
Georgi Kodinov
 
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus
 
How to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good PracticesHow to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good Practices
Globus
 
First Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User EndpointsFirst Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User Endpoints
Globus
 
Cyaniclab : Software Development Agency Portfolio.pdf
Cyaniclab : Software Development Agency Portfolio.pdfCyaniclab : Software Development Agency Portfolio.pdf
Cyaniclab : Software Development Agency Portfolio.pdf
Cyanic lab
 
Quarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden ExtensionsQuarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden Extensions
Max Andersen
 
Using IESVE for Room Loads Analysis - Australia & New Zealand
Using IESVE for Room Loads Analysis - Australia & New ZealandUsing IESVE for Room Loads Analysis - Australia & New Zealand
Using IESVE for Room Loads Analysis - Australia & New Zealand
IES VE
 
Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604
Fermin Galan
 
May Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdfMay Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdf
Adele Miller
 
SOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBrokerSOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar
 
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
Juraj Vysvader
 
Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...
Globus
 
Accelerate Enterprise Software Engineering with Platformless
Accelerate Enterprise Software Engineering with PlatformlessAccelerate Enterprise Software Engineering with Platformless
Accelerate Enterprise Software Engineering with Platformless
WSO2
 
Prosigns: Transforming Business with Tailored Technology Solutions
Prosigns: Transforming Business with Tailored Technology SolutionsProsigns: Transforming Business with Tailored Technology Solutions
Prosigns: Transforming Business with Tailored Technology Solutions
Prosigns
 
Large Language Models and the End of Programming
Large Language Models and the End of ProgrammingLarge Language Models and the End of Programming
Large Language Models and the End of Programming
Matt Welsh
 
Enterprise Resource Planning System in Telangana
Enterprise Resource Planning System in TelanganaEnterprise Resource Planning System in Telangana
Enterprise Resource Planning System in Telangana
NYGGS Automation Suite
 
Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...
Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...
Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...
Shahin Sheidaei
 
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptxTop Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
rickgrimesss22
 
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Anthony Dahanne
 

Recently uploaded (20)

Enhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdf
Enhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdfEnhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdf
Enhancing Project Management Efficiency_ Leveraging AI Tools like ChatGPT.pdf
 
2024 RoOUG Security model for the cloud.pptx
2024 RoOUG Security model for the cloud.pptx2024 RoOUG Security model for the cloud.pptx
2024 RoOUG Security model for the cloud.pptx
 
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024
 
How to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good PracticesHow to Position Your Globus Data Portal for Success Ten Good Practices
How to Position Your Globus Data Portal for Success Ten Good Practices
 
First Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User EndpointsFirst Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User Endpoints
 
Cyaniclab : Software Development Agency Portfolio.pdf
Cyaniclab : Software Development Agency Portfolio.pdfCyaniclab : Software Development Agency Portfolio.pdf
Cyaniclab : Software Development Agency Portfolio.pdf
 
Quarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden ExtensionsQuarkus Hidden and Forbidden Extensions
Quarkus Hidden and Forbidden Extensions
 
Using IESVE for Room Loads Analysis - Australia & New Zealand
Using IESVE for Room Loads Analysis - Australia & New ZealandUsing IESVE for Room Loads Analysis - Australia & New Zealand
Using IESVE for Room Loads Analysis - Australia & New Zealand
 
Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604
 
May Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdfMay Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdf
 
SOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBrokerSOCRadar Research Team: Latest Activities of IntelBroker
SOCRadar Research Team: Latest Activities of IntelBroker
 
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...
 
Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...
 
Accelerate Enterprise Software Engineering with Platformless
Accelerate Enterprise Software Engineering with PlatformlessAccelerate Enterprise Software Engineering with Platformless
Accelerate Enterprise Software Engineering with Platformless
 
Prosigns: Transforming Business with Tailored Technology Solutions
Prosigns: Transforming Business with Tailored Technology SolutionsProsigns: Transforming Business with Tailored Technology Solutions
Prosigns: Transforming Business with Tailored Technology Solutions
 
Large Language Models and the End of Programming
Large Language Models and the End of ProgrammingLarge Language Models and the End of Programming
Large Language Models and the End of Programming
 
Enterprise Resource Planning System in Telangana
Enterprise Resource Planning System in TelanganaEnterprise Resource Planning System in Telangana
Enterprise Resource Planning System in Telangana
 
Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...
Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...
Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...
 
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptxTop Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
 
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
Paketo Buildpacks : la meilleure façon de construire des images OCI? DevopsDa...
 

Deploy and Secure Your API Gateway with NGINX: From Zero to Hero – APCJ

  • 1. Deploy and Secure Your API Gateway with NGINX FROM ZERO TO HERO Scott van Kalken Solution Architect November 17, 2021
  • 2. | ©2021 F5 | NGINX SPRINT APAC 2.1 2 Scott van Kalken Everyone just calls me svk (it’s easier) Interested in devops and application testing. Super passionate about open source (not just software, but data too) I have the privilege of helping run a few meetups.
  • 3. | ©2021 F5 3 • What is a (REST) API? • API essentials – what do users and owners want? • What are API Gateways and how do they help deliver mission-critical digital experiences? • Deploying NGINX as an API Gateway • Securing an API Gateway using NGINX App Protect WAF Table of contents
  • 4. | ©2021 F5 4 What is a (REST) API?
  • 5. | ©2021 F5 6 Developers provide dedicated URLs that are optimized to return pure data to requesting clients Web client à Web server à Request returns HTML API client à API Endpoint à Request returns data API endpoint EASY TO CONSUME DATA
  • 6. | ©2021 F5 7 Components of an API request a) API endpoint (URL) b) API method c) Request body (if sending a POST/PUT request) d) API client -> curl, postman, client application, etc…
  • 7. | ©2021 F5 10 Anatomy of an API call API Client Internet API(s)
  • 8. | ©2021 F5 11 $ curl -s -X GET https://pokeapi.co/api/v2/pokemon/ditto | jq '.types' [ { "slot": 1, "type": { "name": "normal", "url": "https://pokeapi.co/api/v2/type/1/" } } ]
  • 9. | ©2021 F5 12 $ curl -sI https://pokeapi.co/api/v2/pokemon/ditto HTTP/2 200 date: Wed, 06 Oct 2021 16:06:01 GMT content-type: application/json; charset=utf-8
  • 10. | ©2021 F5 13 API Essentials What do users and owners want
  • 11. | ©2021 F5 14 APIS ARE EXPERIENCING EXPLOSIVE GROWTH The rise of APIs
  • 12. | ©2021 F5 15 Drivers for API Adoption Ease access to information • Break down siloes and unlock data (within and among organizations) • Increase collaboration amongst developers Create new digital revenue streams • New opportunities to generate revenue • Build partnerships with third-party developers and business ecosystem Connect microservices • Primary interface for communication amongst microservices
  • 13. | ©2021 F5 18 API essentials USERS / CONSUMER Documentation Ease of use Low latency Security
  • 14. | ©2021 F5 19 Developer productivity Revenue growth API essentials OWNERS Customer experience Brand protection
  • 15. | ©2021 F5 20 API Gateways How do they help deliver mission-critical digital experiences
  • 16. | ©2021 F5 21 AUTHENTICATION REQUEST ROUTING TRAFFIC CONTROL EXCEPTION HANDLING
  • 17. | ©2021 F5 22 Anatomy of an API call API Client Internet / WAN API Gateway API(s)
  • 18. | ©2021 F5 23 API gateway essentials CONTROL ACCESS TO YOUR APIS • Centralized logging • Client authentication • Fine grained access control • Load balancing • Rate limiting • Request routing • Request/response manipulation • Service discovery of backends • TLS termination
  • 19. | ©2021 F5 24 PERFORMANCE IS KEY API gateway essentials 30 ms ... to process an API request end-to-end ... to route, shape, authenticate, secure, and cache an API @p99 (latency)
  • 20. | ©2021 F5 25 NGINX Plus as an API Gateway
  • 21. | ©2021 F5 27 30% Source: NGINX User Survey 2020 of NGINX deployments are as an API Gateway
  • 22. | ©2021 F5 28 ACCESS YOUR APIS IN LESS THAN 30MS EVEN WHEN USING AN API GATEWAY What makes NGINX API Gateways special?
  • 24. | ©2021 F5 31 NGINX API gateway KEY STRENGTHS High performance for real-time APIs DevOps friendly Platform flexibility Distributed environments
  • 25. | ©2021 F5 32 Authentication options API gateway HTTP basic Client cert JWT (NGINX Plus) API key
  • 26. | ©2021 F5 33 API Security
  • 27. | ©2021 F5 35 • “The continuous growth in open source usage” • “A substantial increase in security research, resulting in a rise in the number of reported security issues including a high number of API vulnerabilities” • “The growing popularity of containerized environments, which suffer from a high volume of code and configuration issues” FORRESTER’S STATE OF APPLICATION SECURITY REPORT 2021 Bridging the Gap Between Security and Dev Source: https://www.whitesourcesoftware.com/resources/blog/forre sters-state-of-application-security-2021-key-takeaways/
  • 30. | ©2021 F5 60 In conclusion…
  • 31. | ©2021 F5 61 = Step 1 – api’s Step 2 – custom error messages Step 3 – add URI request routing Step 4 – add rate limiting Step 8 – Web Application Firewall Step 5 – static API key Step 6 - JWT Step 7 - Input validation
  • 32. | ©2021 F5 62 Resources FIND OUT MORE! https://www.nginx.com/resources/library/nginx-api-gateway-deployment https://www.nginx.com/blog/deploying-nginx-plus-as-an-api-gateway-part-1/
  • 33. | ©2021 F5 63 DEPLOY AND SECURE YOUR API GATEWAY WITH NGINX’S FREE TRIAL -> HTTPS://WWW.NGINX.COM/FREE-TRIAL-REQUEST/ Check out NGINX Plus and NGINX App Protect!