News for hackers. Stuff that matters.

A comment on Apache Apisix: Open-Source API Gateway and API Management Platform. Parent comment

Re:Apache Apisix: Open-Source API Gateway and API Management... by chao-zhang on Thursday September 15, 2022 @09:07PM (#32860710)
Apache APISIX also has several security features to help reinforce API security. For instance:

1. It can dynamically manage lots of TLS certificates and do the TLS/SSL terminate or use mTLS to communicate with the upstream; 2. Plugins like ACL, IP Restriction, CSRF, and Referrer Restriction restrict API access in different dimensions.

[ Parent | on HN ]
Re:Apache Apisix: Open-Source API Gateway and API Management... by adamckay on Friday September 16, 2022 @04:42PM (#32871780)
Is it possible to perform mTLS from client->APISIX gateway and pass on the verified certificate details to the upstream (e.g. via headers)?

Or is mTLS only possible with client->pass through APISIX->upstream? It's not quite clear from the docs.

[ Parent | on HN ]
Re:Apache Apisix: Open-Source API Gateway and API Management... by bzp2010 on Saturday September 17, 2022 @02:13AM (#32875191)
As a complement to the first reply, I created a simple DEMO that will implement your needs and I placed it on the GitHub gist [1].

[1] https://gist.github.com/bzp2010/6ce0bf7c15c191029ed547245471...

[ Parent | on HN ]
Re:Apache Apisix: Open-Source API Gateway and API Management... by chao-zhang on Saturday September 17, 2022 @12:50AM (#32874844)
It's feasible while you have to write a bit of code to assemble the certificate details to the API request (e.g., request headers, or query string).

mTLS is both possible for client -> APISIX and APISIX -> upstream.

[ Parent | on HN ]