How to build APISIX in SLES 15

By reading this article you will learn how to build Apache APISIX SLES 15 from source code. The build process will be done in the SLE BCI 15 SP5 Base Container

Fixing duplicate API requests

The first rule of distributed systems is "Don’t distribute your system". Designing distributed systems right is infamously hard for multiple reasons.

Monthly Report (March 01 - March 31)

We have recently made some additions and improvements to specific features within Apache APISIX. For detailed information, please read the monthly report.

Release Apache APISIX 3.9.0

We are glad to present Apache APISIX 3.9.0 with exciting new features, bug fixes, and other improvements to user experiences.

Apache APISIX North America Tour

Once in a while, I write non-technical blog posts when I've something worth sharing. Today, I'd like to write about my North America "Tour" across several conferences and user groups.

Monthly Report (January 29 - February 29)

We have recently made some additions and improvements to specific features within Apache APISIX. For detailed information, please read the monthly report.

Secure your API with these 16 Practices with Apache APISIX - part 2

Last week, we listed 16 practices to help secure one's APIs and described how to implement them with Apache APISIX.

1. Authentication 🕵️️ - Verifies the identity of users accessing APIs.
2. Authorization 🚦 - Determines permissions of authenticated users.
3. Data Redaction 🖍️ - Obscures sensitive data for protection.
4. Encryption 🔒 - Encodes data so only authorized parties can decode it.
5. Error Handling ❌ - Manages responses when things go wrong, avoiding revealing sensitive info.
6. Input Validation & Data Sanitization 🧹 - Checks input data and removes harmful parts.
7. Intrusion Detection Systems 👀 - Monitor networks for suspicious activities.
8. IP Whitelisting 📝 - Permits API access only from trusted IP addresses.
9. Logging and Monitoring 🖥️ - Keeps detailed logs and regularly monitors APIs.
10. Rate Limiting ⏱️ - Limits user requests to prevent overload.
11. Secure Dependencies 📦 - Ensures third-party code is free from vulnerabilities.
12. Security Headers 📋 - Enhances site security against types of attacks like XSS.
13. Token Expiry ⏳ - Regularly expiring and renewing tokens prevents unauthorized access.
14. Use of Security Standards and Frameworks 📘 - Guides your API security strategy.
15. Web Application Firewall 🔥 - Protects your site from HTTP-specific attacks.
16. API Versioning 🔄 - Maintains different versions of your API for seamless updates.

This week, we will look at the remaining practices.

Secure your API with these 16 Practices with Apache APISIX - part 1

A couple of months ago, I stumbled upon this list of Secure your API with these 16 practices to secure your API:

1. Authentication 🕵️️ - Verifies the identity of users accessing APIs.
2. Authorization 🚦 - Determines permissions of authenticated users.
3. Data Redaction 🖍️ - Obscures sensitive data for protection.
4. Encryption 🔒 - Encodes data so only authorized parties can decode it.
5. Error Handling ❌ - Manages responses when things go wrong, avoiding revealing sensitive info.
6. Input Validation & Data Sanitization 🧹 - Checks input data and removes harmful parts.
7. Intrusion Detection Systems 👀 - Monitor networks for suspicious activities.
8. IP Whitelisting 📝 - Permits API access only from trusted IP addresses.
9. Logging and Monitoring 🖥️ - Keeps detailed logs and regularly monitors APIs.
10. Rate Limiting ⏱️ - Limits user requests to prevent overload.
11. Secure Dependencies 📦 - Ensures third-party code is free from vulnerabilities.
12. Security Headers 📋 - Enhances site security against types of attacks like XSS.
13. Token Expiry ⏳ - Regularly expiring and renewing tokens prevents unauthorized access.
14. Use of Security Standards and Frameworks 📘 - Guides your API security strategy.
15. Web Application Firewall 🔥 - Protects your site from HTTP-specific attacks.
16. API Versioning 🔄 - Maintains different versions of your API for seamless updates.

While it's debatable whether some points relate to security, e.g.,, versioning, the list is a good starting point anyway. In this two-post series, I'd like to describe how we can implement each point with Apache APISXI (or not).

Hardening Apache APISIX with the OWASP's Coraza and Core Ruleset

The Open Worldwide Application Security Project is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of IoT, system softw...

--OWASP website

The OWASP regularly publishes a Top 10 vulnerability report. The report targets vulnerabilities in web applications.

In this post, I'd like to describe how to fix some of them via the Apache APISIX API Gateway.