Skip to content
Ameen Abozaid
Englishالعربية
MID-051

Advanced API security

  • 5 Lessons
  • 2.5 h practice (estimate)
Start module
On this page 8 topics

Overview

Topics

  • OAuth 2.0 flows
  • OIDC
  • token validation
  • authorization design

Learn first

2.5 h of practice (estimate)

Learning outcomes

  1. Choose OAuth 2.0 flows for user-facing, machine-to-machine, and delegated scenarios.
  2. Validate tokens fully at every service, not only at the gateway.
  3. Design scopes and claims for fine-grained authorization, and propagate user identity between services.
  4. Apply token exchange or client credentials for service-to-service calls.

Lessons

  1. 01OAuth flows revisited
  2. 02Token validation everywhere
  3. 03Scopes, claims, and authorization design
  4. 04Service-to-service identity
  5. 05Demo: propagating identity from gateway to inventory

Lab and exercises

Lab

MID-051-LAB1 · Zero implicit trust

Outcomes: 1–4 · Time: ~2.5 h Every Shop service validates tokens; orders calls inventory with its own client credentials; scopes restrict admin operations. Acceptance: a direct call without a valid token fails at every service.

Exercises (assessment: authorization design review)

IDOutcomeTask
MID-051-EX011Choose a flow for each: web storefront, mobile app, nightly report job, support tool acting for a customer.
MID-051-EX022Configure a service as a resource server with issuer and audience validation.
MID-051-EX032Write tests: expired token, wrong audience, missing token, tampered signature.
MID-051-EX043Design scopes and roles for orders and inventory and fill in the endpoint matrix.
MID-051-EX053Add an ownership check and a negative test for reading another customer's order.
MID-051-EX064Configure orders to obtain a client-credentials token for inventory; limit its scopes.
MID-051-EX071–4Review a given design (gateway-only validation, header-based identity, shared service account) and list fixes.
Show solutions
  • EX01 Storefront and mobile: authorization code with PKCE; nightly job: client credentials; support tool acting for the customer: token exchange (or a delegated, audited flow).
  • EX02 issuer-uri plus a JwtValidator checking aud; verify the exact Spring Security version API before recording.
  • EX03 Expect 401 for missing, expired, tampered, and wrong audience tokens.
  • EX04 Example: orders:read customer; orders:admin support role; inventory:write only for orders client and admin.
  • EX05 Compare the order's owner with the token subject; return 404 or 403 for others; test with two users.
  • EX06 Register an orders client with the inventory:read scope only; use a client-credentials WebClient filter.
  • EX07 Validate tokens in every service, take identity from the token, one client per service with minimal scopes.

Quiz

Outcomes: O1 OAuth flows · O2 token validation · O3 scopes, claims, authorization design · O4 service-to-service identity.

A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.

  1. 1A user-facing SPA should use:O1
  2. 2A nightly job with no user should use:O1
  3. 3Validating tokens only at the gateway is risky because:O2
  4. 4The audience claim ensures:O2
  5. 5An X-User-Id header set by the gateway:O2
  6. 6Scopes describe:O3
  7. 7The check that stops one customer reading another's order is:O3
  8. 8Admin operations should:O3
  9. 9orders calls inventory with:O4
  10. 10Token exchange is used to:O4

Practical part

Seven exercises MID-051-EX01 to EX07 (EX07 is the authorization design review) plus the zero-implicit-trust lab. Pass: at least five exercises including EX07, and a lab where a direct call without a valid token fails at every service.

Common mistakes

Trusting a header set by the gateway; one all-powerful service account.

Assessment

Authorization design review.

Career relevance

Zero-trust security architecture (SRB-016).

Type to search levels, phases, modules and lessons.