使い方
- インストールコマンドをコピーし、自分の環境へ導入する前にソースを確認します。
- 必要なツール、認証情報、対応環境を原文で確認します。
- 入力と成果物を指定し、出力を資料と照合します。
npx skills add https://github.com/vaquarkhan/fullstack-development-agent-skills --skill api-gateway-and-edge-security開始前の確認
- 導入にはモデル契約、API枠、ファイルへのアクセス許可は含まれません。
- スター数や導入数は活動の指標であり、独立した品質・安全性試験ではありません。
リポジトリの原文
見出し、例、コード、表、リンク、参照画像を含む原文を表示しています。
API Gateway And Edge Security
Use When
- Exposing APIs to public clients or partners
- Centralized edge policy is required for governance
Workflow
- Define route-level authn and authz requirements.
- Configure request validation and schema enforcement at edge.
- Apply IP, token, and tenant-aware rate limiting.
- Add WAF, bot mitigation, and abuse detection rules.
- Emit security audit logs and anomaly alerts.
Required Checks
- Unauthorized traffic is blocked before backend invocation
- Sensitive headers and payload fields are sanitized
- Rate limits protect downstream services under burst traffic
Decision Framework
- Enforce server-side authorization as the source of truth for access decisions.
- Use least-privilege scopes and role mappings by default.
- If tokens are used, define validation, rotation, and revocation behavior explicitly.
- If external identity providers are involved, define outage and fallback behavior.
Common Rationalizations And Rebuttals
- "Client checks are enough." -> Client logic is bypassable; enforce checks on backend boundaries.
- "Broad scopes are easier to manage." -> Broad scopes increase blast radius and compliance risk.
- "We can add audit logs later." -> Missing audit evidence blocks incident and compliance response.
Evidence Pack
- Negative test cases for unauthorized and malformed access attempts
- Scope-to-permission mapping with owner approval
- Token/session lifecycle flow and revocation behavior proof
- Audit and security monitoring evidence for sensitive operations
Exit Criteria
- Edge security posture is enforceable and monitored
- API consumers receive consistent error and quota semantics
