APISIX Security Guide

Introduction

Security is crucial for API gateways. This guide covers essential security features and best practices for APISIX implementations.

Security Notice:

Always follow security best practices and keep APISIX updated to the latest stable version to protect against vulnerabilities.

Authentication

Authentication Methods

JWT Authentication

{
    "plugins": {
        "jwt-auth": {
            "key": "user-key",
            "secret": "my-secret-key",
            "exp": 86400,
            "algorithm": "HS256"
        }
    }
}

Key Authentication

{
    "plugins": {
        "key-auth": {
            "key": "auth-one",
            "header": "X-API-KEY"
        }
    }
}

SSL/TLS Configuration

SSL Settings

{
    "cert": "...",
    "key": "...",
    "sni": "*.example.com",
    "snis": ["api.example.com", "admin.example.com"]
}

Note: Always use strong SSL/TLS configurations and keep certificates up to date.

Access Control

IP Restriction

{
    "plugins": {
        "ip-restriction": {
            "whitelist": [
                "192.168.1.0/24",
                "10.20.0.0/16"
            ],
            "blacklist": [
                "10.0.0.1"
            ]
        }
    }
}

Rate Limiting

Traffic Control

{
    "plugins": {
        "limit-req": {
            "rate": 5,
            "burst": 10,
            "key_type": "var",
            "key": "remote_addr"
        }
    }
}

Web Application Firewall

WAF Configuration

{
    "plugins": {
        "waf": {
            "rules": [
                "rule-set-main",
                "rule-set-sensitive"
            ],
            "log_level": "warn"
        }
    }
}

Security Monitoring

Monitoring Setup

{
    "plugins": {
        "prometheus": {},
        "syslog": {
            "host": "localhost",
            "port": 5044,
            "timeout": 1000
        }
    }
}

Security Best Practices

Implementation Guidelines

Use strong authentication methods
Enable SSL/TLS for all traffic
Implement rate limiting
Configure proper access controls
Enable security monitoring
Regularly update APISIX
Audit security configurations