kidwellj
/
findcommonground.uk
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #36 from DonMartin76/master 

Added note on OAuth not being part of this blog post
This commit is contained in:
Raul Firu 2016-02-15 14:05:31 +01:00
parent f8736eca36 736082ca74
commit b3f8154bfc
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
_posts/2016-02-15-securing-backends-azure-apim.md
View File

@ -25,6 +25,9 @@ We will check out the following possibilities:
* Virtual Networks and Network Security Groups
* VPNs
What is not part of this blog post is how you also can use OAuth related techniques to secure backend services. Focus of this article is how to technically secure the backends, not using means such as OAuth.
### Security by obscurity
For some very non-critical backend services running in the same Azure region (and only in those cases), it may be enough to secure the backend via obscurity; some have suggested that it can be enough to check for the `Ocp-Apim-Subscription-Key` header which will by default be passed on from the client via the API gateway to the backend service (unless you filter it out via some policy).