implementing-api-gateway-security-controls

Files (4)

• LICENSE
• SKILL.md
• api-reference.md · references/
• agent.py · scripts/

SKILL.md (first lines)

# Implementing API Gateway Security Controls

## When to Use

- Deploying a centralized authentication and authorization layer for microservice APIs
- Implementing rate limiting, throttling, and quota management across all API endpoints
- Configuring request/response validation against OpenAPI specifications at the gateway level
- Setting up TLS termination, mutual TLS, and certificate management for API traffic
- Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

**Do not use** as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

## Prerequisites

- API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)
- OpenAPI/Swagger specifications for all backend APIs
- TLS certificates for the gateway domain
- Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)
- Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)
- Backend service endpoints registered and reachable from the gateway

## Workflow

### Step 1: Kong Gateway Security Configuration

```yaml
# kong.yml - Declarative Kong configuration with security plugins
_format_version: "3.0"

services:
  - name: user-service
    url: http://user-service:8080
    routes:
      - name: user-api
        paths:
          - /api/v1/users
        methods:
          - GET
          - POST
          - PUT
          - PATCH
          - DELETE
        strip_path: false

plugins:
  # 1. Authentication: JWT validation
  - name: jwt
    config:
      uri_param_names:
        - jwt
      header_names:
        - Authorization
      claims_to_verify:
        - exp
      maximum_expiration: 3600  # Max 1 hour token TTL

  # 2. Rate Limiting
  - name: rate-limiting
    config:
      minute: 60
      hour: 1000
      policy: redis
      redis_host: redis
      redis_port: 6379
      fault_tolerant: true
      hide_client_headers: false
      limit_by: credential  # Per-user, not per-IP

  # 3. Request Size Limiting
  - name: request-size-limiting
    config:
      allowed_payload_size: 1  # 1 MB max
      size_unit: megabytes

  # 4. IP Restriction (admin endpoints)
  - name: ip-restriction
    service: admin-service
    config:
      allow:
        - 10.0.0.0/8
        - 172.16.0.0/12

  # 5. Bot Detection
  - name: bot-detection
    config:
      deny:
        - "sqlmap"
        - "nikto"
        - "nmap"
        - "masscan"

  # 6. CORS Configuration
  - name: cors
    config:
      origins:
        - "https://app.example.com"
      methods:
        - GET
        - POST
        - PUT
        - PATCH
        - DELETE
      headers:
        - Authorization
        - Content-Type
      credentials: true
      max_age: 3600

  # 7. Response Transformer - Remove sensitive headers
  - name: response-transformer
    config:
      remove:
        headers:
          - X-Powered-By
          - Server
      add:
        headers:
          - "X-Content-Type-Options: nosniff"
          - "X-Frame-Options: DENY"
          - "Strict-Transport-Security: max-age=31536000; includeSubDomains"

From pinkpixel-dev/skills-collection-2, Apache-2.0.

More from pinkpixel-dev/skills-collection-2