Recently, I played around with GitHub Actions and the authentication towards Azure, as you can read in this blog post. I encountered some issues with using environment secrets, that I would like to share with you. Let's have a look! The problem I have a reusable...
I had the privilege to participate in a private preview for Azure API Management integration with Dapr. This functionality is now in public preview for Azure API Management's self-hosted gateway. You can hear about my experiences in this video:...
The problem When authoring Azure API Management policies, I often ask myself "How can I get the value of an HTTP header, without throwing null reference exception if it does not exist?" or "What's the best way to verify an incoming client certificate?". To find the...
Modern API security protocols, like OAuth2 and Open ID Connect, assume that all HTTP traffic is encrypted on the wire, using TLS. Therefor, it is a good security practice to enforce the usage of HTTPS within API Management. In Azure, the Azure Policy engine is...
On my latest project, I developed a global policy to ensure that no stack traces get returned to the API consumer. This is a good security measure, because stack traces reveal too much information about the underlying technology and setup. Inside the All APIs policy,...
It's a good practice to configure backups for your API Management instances in production. A disaster can always occur, so it's better that you are prepared for that. Even when your API Management is completely deployed through automation, this advise still...
As you might know, Microsoft is working hard to create brand new SDKs for most of its services. The goal of this effort is to simplify development, increase productivity, introduce uniformization across SDKs and to focus hard on documentation and samples. An...