2
Reply

How to secure your deployed microservices?

Utpal Dutta

Utpal Dutta

2y
2.7k
1
Reply

You have multiple microservices.All microservices are deployed in Azure. Microservices are exposed to outside through Azure APIM. How we can secure our microservices here.

    To secure deployed microservices, multiple security practices are applied at different levels such as authentication, authorization, communication, and infrastructure. First, authentication and authorization should be implemented using secure standards like OAuth 2.0 and JWT (JSON Web Tokens) to ensure only verified users or services can access APIs. Using an API Gateway such as Kong API Gateway or NGINX helps centralize security features like request validation, rate limiting, and authentication before requests reach the microservices. Secure communication between services must be ensured by using HTTPS and TLS encryption to protect data during transmission. Implementing service-to-service authentication with tools like Istio service mesh can further secure internal communication. Additionally, proper access control and role-based permissions (RBAC) should be used so that each service or user has only the required privileges. Sensitive data such as API keys and passwords should be stored securely using secret management systems instead of hardcoding them. Regular logging, monitoring, and vulnerability scanning should also be performed to detect and respond to potential security threats quickly. These combined practices help ensure that microservices remain secure in production environments.

    HI Utpal,
    You Can do below things to secure API in apart from Azure API Managment Security
    1) Enable Cors
    2)JWT Authentication/Any Other Token managment
    2) URI Refererer Attribute In Controller/Method Level if Somebody bypass Authentication

    Here The Filer will ensure APi should not call directly except from below urls

    public class APIRefererAuthorizeAttribute : TypeFilterAttribute
    {
    string[] origins = null;
    public APIRefererAuthorizeAttribute() : base(typeof(ApiAuthorizeFilter))
    {

    1. origins=new string[] { "https://localhost:5500/", "https://xyz.com" };
    2. Arguments = new object[] { origins };
    3. }

    }

    For Azure API Managment Level Security , please refer below articles
    https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats

    https://dev.to/koheikawata/azure-api-management-authentication-part1-1198