Skip to content

API Security

API Security and Discovery

In order to integrate API security and discovery features with the agent we would most likely need to changes within the agent module. Below is a high-level diagram as to how it might look. It seems most natural to add an API security module within the inspector which would be responsible for enforcing API security while feeding the spec via the same mechanism that rules are read in. If API discovery is the only objective it perhaps we would publish the request messages to a seperate module from the inspector, since that would have no bearing on the OK / Block decision.

API Discovery Integration

Meeting 7/6/2022 with Nathan, Alex and Sada

  • if we only focus on discovery we could have a seperate module that reads requests from the queue without directly affecting the agent
  • however that doesn't make sense from a marketing perspective to offer customers discovery without allowing them to use security as discovery is not all that useful in itself. It's far more useful for a customer to use discovery in conjunction with the capacity of being able to enforce it
  • we would need to integrate more deeply with the agent if our API security has bearing on block/non-block decisions, further we would want to integrate and capture signal information and send that back to the cloud as part of our solution
  • we could keep things simple and upload the specs to the file system to begin with (as opposed to going through an S3 bucket)
  • performance impact should be minimal if we are validating directly against an API spec, since we wouldn't be using anything process intensive such as reflection
  • a partnership doesn't quite fit given the amount of integration required to enforce the block/non-block decisions as well as the sending and ingestion of signals on top of which we're unsure if we should be giving a partner access to signals we generate from our other traffic
  • there could be additional benefits of building this in-house by allowing us to augment the API spec check with other signals we generate
  • perhaps it would be possible to use third-party libraries to help with some of the features such as Open API spec (OAS) generation
  • we could use some of the code within Speculator to assist with OAS generation but this would need to be heavily modified