Issue 207: Tinder API gateway, runtime secrets protection for mobile APIs, and Open Banking APIs
Brief
This week, we take a deep dive into the Tinder API gateway and how it solves security challenges. We also have an article from Approov on how to protect runtime secrets for mobile APIs, and an article on Open Banking API security best practices. Finally, we look at how software bill of materials (SBOMs) can aid API attacks.
Article: Deep dive into the Tinder API gateway
API gateways are a pillar of API security, especially in enforcing transport security and rate limiting. I was interested to read the unusual approach taken by Tinder (yes, that Tinder), who took the unusual step of building their own API gateway solution: Tinder API Gateway (TAG).
Their main justification for this decision was the inability to scale their current environment of over 500 microservices and several different API gateways across application teams.