A core component of NASA's Gateway lunar space station just passed a grueling round of pressure tests, a big win for the project.

NASA’s Lunar Space Station Just Took a Massive Step Towards Launching

Cybersecurity certifications offer a multitude of benefits for both employees and employers.

Cybersecurity Certifications: The Gateway to Career Advancement

CLEVELAND, June 24, 2022 /PRNewswire/ -- Downtown Cleveland gains a new Rally House store in the historic Caxton Building within the Gateway District. Rally House Gateway is conveniently situated down the street from Rocket Mortgage FieldHouse, Progressive Field, and FirstEnergy Stadium, a ...

Baseten Announces the Launch of Baseten on Google Cloud Marketplace with 
Early Access for Hybrid Mode, Delivering Exceptional Flexibility and Scale 
for AI Workloads

Tricon Garage driver Corey Heim won his fourth NASCAR Craftsman Truck Series race of 2024 at World Wide Technology Raceway.

Corey Heim dominates Gateway for fourth Truck Series win of 2024

Corey Heim leads a race-high 65 laps on his way to the NASCAR Craftsman Truck Series win at World Wide Technology Raceway at <strong>Gateway</strong>.

Corey Heim dominates Gateway for fourth win of 2024 | NASCAR

Phil Bobbitt and Steve Greco revealed their NASCAR picks for the 2024 Enjoy Illinois 300 at World Wide Technology Raceway

2024 Enjoy Illinois 300 props, Gateway odds, expert picks, prediction, field: Use Tyler Reddick in NASCAR bets - CBSSports.com

Elsewhere, the aforementioned Busch will be hoping for his first win of 2024 at the track where he won in 2023, beating out Denny Hamlin and Joey Logano in the process. It should be an awesome afternoon in <strong>Gateway</strong> Motorsports Park.

Michael McDowell wins pole as Ford, Toyota dominate NASCAR qualifying at Gateway - On3

Gateway, Inc., previously Gateway 2000, Inc., was an <strong>American computer company originally based in Iowa and South Dakota</strong>. Founded by Ted Waitt and Mike Hammond in 1985, the company developed, manufactured, supported, and marketed a wide range of personal computers, computer monitors, servers, ...

Gateway, Inc. - Wikipedia

<strong>The iconic cow-spotted company</strong> dominated computer sales for years throughout this decade, far outperforming rivals in the market by insurmountable margins. And yet, Gateway failed to survive only a decade after reaching $10 billion in annual sales. What happened?

The Real Reason Gateway Failed Spectacularly - History-Computer

<strong>Founded in 1985 in an Iowa farmhouse</strong>, Gateway has grown into one of America&#x27;s best-known brands with millions of satisfied customers. The company received national acclaim in 1991 when it introduced its distinctive cow-spotted boxes, a tribute to its farm heritage.

Gateway | LinkedIn

Gateway

gateway

Kerberoasting: A Gateway to Privilege Escalation in Enterprise Networks

Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Redefining Crypto Payment Standards With a proven track record of over three years in the industry, Cryptix has established itself as a trusted partner for online businesses globally. The company’s entry into Europe marks a significant milestone, offering advanced crypto payment solutions tailored to the needs of European enterprises. By seamlessly converting digital assets into fiat currencies or stablecoins, Cryptix is set to become a vital player in the region’s digital economy. A Global Vision with Local Benefits Cryptix’s expansion isn’t just about geographical growth; it’s about inclusivity and adaptability in the rapidly evolving world of digital finance. Alongside support for EUR and USD, Cryptix now accommodates MXN (Mexican Peso), BRL (Brazilian Real), and COP (Colombian Peso), reflecting its commitment to serving a diverse clientele. European businesses can now tap into broader markets with ease, leveraging Cryptix’s ability to facilitate transactions in multiple currencies. Streamlined Integration and User Experience What sets Cryptix apart is its focus on simplicity and efficiency. Businesses can integrate Cryptix into their operations via API or HTML iFrame, ensuring a smooth setup process. For those seeking a no-code solution, Cryptix offers an intuitive payment link generation feature, enabling swift transactions without the need for technical expertise. The comprehensive dashboard provided by Cryptix consolidates all essential functions into a single interface—managing conversions, top-ups, transaction histories, mass payouts, and withdrawals has never been easier. To combat the volatility inherent in cryptocurrency markets, Cryptix’s auto-conversion feature instantly converts crypto payments into stablecoins or fiat currencies, shielding businesses from exchange rate fluctuations**.** Unrivaled Value Proposition As Cryptix enters the European market, it does so with a clear value proposition: unparalleled transaction limits and minimal fees. Businesses can process up to $10,000 in transactions without requiring Know Your Business (KYB) verification. Upon verification, the sky's the limit—literally, with no upper cap on transaction volumes. Cryptix’s fee structure is another game-changer. With no charges for cryptocurrency top-ups or crypto-to-crypto exchanges, and a 0% fee for crypto-to-fiat conversions, the platform is among the most cost-effective in the industry. A modest 0.4% fee for accepting crypto payments and a 0.6% fee for fiat settlements further underscores Cryptix’s commitment to offering businesses a competitive edge in a burgeoning market. Positioning for the Future Cryptix’s European expansion signals more than just growth—it’s a bold statement of intent. As businesses across the continent grapple with the complexities of digital finance, Cryptix is set to provide them with the tools they need to thrive. By reducing barriers to entry and ensuring cost-effectiveness, Cryptix is not only entering the European market but is set to dominate it. For inquiries, please reach out at contact@cryptix.io About Cryptix.io Cryptix remains at the forefront of compliance, adhering strictly to Counterterrorism Financing (CTF) and Anti-Money Laundering (AML) regulations. Registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Cryptix ensures the highest standards of safety and integrity in its operations. Committed to supporting small and medium-sized enterprises (SMEs), Cryptix empowers businesses to harness the potential of digital currencies, driving economic growth across regions. Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Redefining Crypto Payment Standards Redefining Crypto Payment Standards With a proven track record of over three years in the industry, Cryptix has established itself as a trusted partner for online businesses globally. The company’s entry into Europe marks a significant milestone, offering advanced crypto payment solutions tailored to the needs of European enterprises. By seamlessly converting digital assets into fiat currencies or stablecoins, Cryptix is set to become a vital player in the region’s digital economy. A Global Vision with Local Benefits A Global Vision with Local Benefits Cryptix’s expansion isn’t just about geographical growth; it’s about inclusivity and adaptability in the rapidly evolving world of digital finance. Alongside support for EUR and USD, Cryptix now accommodates MXN (Mexican Peso), BRL (Brazilian Real), and COP (Colombian Peso), reflecting its commitment to serving a diverse clientele. European businesses can now tap into broader markets with ease, leveraging Cryptix’s ability to facilitate transactions in multiple currencies. Streamlined Integration and User Experience Streamlined Integration and User Experience What sets Cryptix apart is its focus on simplicity and efficiency. Businesses can integrate Cryptix into their operations via API or HTML iFrame, ensuring a smooth setup process. For those seeking a no-code solution, Cryptix offers an intuitive payment link generation feature, enabling swift transactions without the need for technical expertise. The comprehensive dashboard provided by Cryptix consolidates all essential functions into a single interface—managing conversions, top-ups, transaction histories, mass payouts, and withdrawals has never been easier. To combat the volatility inherent in cryptocurrency markets, Cryptix’s auto-conversion feature instantly converts crypto payments into stablecoins or fiat currencies, shielding businesses from exchange rate fluctuations**.** Unrivaled Value Proposition Unrivaled Value Proposition As Cryptix enters the European market, it does so with a clear value proposition: unparalleled transaction limits and minimal fees. Businesses can process up to $10,000 in transactions without requiring Know Your Business (KYB) verification. Upon verification, the sky's the limit—literally, with no upper cap on transaction volumes. Cryptix’s fee structure is another game-changer. With no charges for cryptocurrency top-ups or crypto-to-crypto exchanges, and a 0% fee for crypto-to-fiat conversions, the platform is among the most cost-effective in the industry. A modest 0.4% fee for accepting crypto payments and a 0.6% fee for fiat settlements further underscores Cryptix’s commitment to offering businesses a competitive edge in a burgeoning market. Positioning for the Future Positioning for the Future Cryptix’s European expansion signals more than just growth—it’s a bold statement of intent. As businesses across the continent grapple with the complexities of digital finance, Cryptix is set to provide them with the tools they need to thrive. By reducing barriers to entry and ensuring cost-effectiveness, Cryptix is not only entering the European market but is set to dominate it. For inquiries, please reach out at contact@cryptix.io For inquiries, please reach out at contact@cryptix.io contact@cryptix.io contact@cryptix.io About Cryptix.io About Cryptix.io Cryptix remains at the forefront of compliance, adhering strictly to Counterterrorism Financing (CTF) and Anti-Money Laundering (AML) regulations. Registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Cryptix ensures the highest standards of safety and integrity in its operations. Committed to supporting small and medium-sized enterprises (SMEs), Cryptix empowers businesses to harness the potential of digital currencies, driving economic growth across regions. Cryptix Cryptix

Cryptix Revolutionizes Crypto Payments in Europe with Innovative Gateway Solutions

Cryptix ukax Europa uksanx Crypto Payllawinakx Revolucionawayiwa, Innovative Gateway Solutions ukampi

Cryptix revoluciona los pagos con criptomonedas en Europa con soluciones de pasarela innovadoras

A Cryptix innovatív átjárómegoldásaival forradalmasítja a kriptográfiai fizetéseket Európában

Cryptix は革新的なゲートウェイ ソリューションでヨーロッパの暗号通貨決済に革命を起こします

Cryptix Европадагы крипто төлөмдөрүн инновациялык шлюз чечимдери менен өзгөртөт

Cryptix revoluționează plățile cripto în Europa cu soluții inovatoare de gateway

Цриптик револуционише крипто плаћања у Европи са иновативним решењима мрежног пролаза

Cryptix бо ҳалли инноватсионии Gateway пардохтҳои криптоиро дар Аврупо инқилоб мекунад

Cryptix ปฏิวัติการชำระเงินด้วย Crypto ในยุโรปด้วยโซลูชันเกตเวย์ที่สร้างสรรค์

Cryptix революціонізує криптовалютні платежі в Європі за допомогою інноваційних рішень для шлюзу

I-Cryptix iguqula iiNtlawulo ze-Crypto eYurophu kunye ne-Innovative Gateway Solutions

In my talk, “Evolving your APIs,” I mention that an API gateway is a Reverse Proxy "on steroids.” One key difference between the former and the latter is that the API Gateway is not unfriendly to business logic. The poster child is rate-limiting. Rate-limiting is an age-old Reverse Proxy feature focused on protecting against Distributed Denial of Service (DDoS) attacks. It treats all clients the same and is purely technical. In this day and age, most API providers offer different subscription tiers; the higher the tier, the higher the rate limit, and the more you pay incidentally. It's not technical anymore and requires to differentiate between clients. In this post, I want to detail how to do it with Apache APISIX. Note I take most of the material from the workshop. Rate-limiting for the masses Apache APISIX offers no less than three plugins to rate limit requests: limit conn: limits the number of concurrent requests
limit req: limits the number of requests based on the Leaky Bucket algorithm
limit count: limits the number of requests based on a fixed time window The limit-count plugin is a good candidate for this post. Let's configure the plugin for a route: routes:
  - uri: /get
    upstream:
      nodes:
        "http://httpbin.org:80": 1
    plugins:
      limit-count:                     #1
        count: 1                       #2
        time_window: 60                #2
        rejected_code: 429             #3
#END Set the limit-count plugin
Limit requests to one every 60 seconds
Override the default HTTP response code, i.e., 503 At this point, we configured regular rate limiting. curl -v http://localhost:9080/get
curl -v http://localhost:9080/get If we execute the second request before a minute has passed, the result is the following: HTTP/1.1 429 Too Many Requests
Date: Tue, 09 Jul 2024 06:55:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 241
Connection: keep-alive
X-RateLimit-Limit: 1                   #1
X-RateLimit-Remaining: 0               #2
X-RateLimit-Reset: 59                  #3
Server: APISIX/3.9.1

<html>
<head><title>429 Too Many Requests</title></head>
<body>
<center><h1>429 Too Many Requests</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html> Configured limit
Remaining quota
Waiting time in seconds before quota replenishment Per-consumer rate limiting To configure per-consumer rate limiting, we first need to implement request authentication. APISIX offers many authentication plugins; we shall use the simplest one, key-auth. key-auth checks a specific HTTP request header - apikey by default. Here's how we configure consumers: consumers:
  - username: johndoe                  #1
    plugins:
      key-auth:
        key: john                      #2
  - username: janedoe                  #1
    plugins:
      key-auth:
        key: jane                      #2 Users
HTTP header request value curl -H 'apikey: john' localhost:9080/get #1
curl -H 'apikey: jane' localhost:9080/get #2 Authenticate as johndoe
Authenticate as janedoe In general, you attach plugins to APISIX routes but can also attach them to consumers. We can now move the limit-count plugin. routes:
  - uri: /get
    upstream:
      nodes:
        "httpbin:80": 1
    plugins:
      key-auth: ~                      #1

consumers:
  - username: johndoe
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    plugins:
      key-auth:
        key: jane
      limit-count:
        count: 5                       #2
        time_window: 60
        rejected_code: 429
#END The route is only accessible to requests authenticating with key-auth
johndoe has a lower limit count than janedoe. Did he forget to pay his subscription fees? curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. Per-group rate limiting We never attach permissions directly to identities in Identity Management systems. It's considered bad practice because when a person moves around the organization, we need to add and remove permissions one by one. The good practice is to attach permissions to groups and set the person in that group. When the person moves, we change their group; the person loses permissions from the old group and gets permissions from the new group. People get their permissions transitively via their groups. Apache APISIX offers an abstraction called a Consumer Group for this. Let's create two consumer groups with different rate limit values: consumer_groups:
  - id: 1
    plugins:
      limit-count:
        count: 1
        time_window: 60
        rejected_code: 429
  - id: 2
    plugins:
      limit-count:
        count: 5
        time_window: 60
        rejected_code: 429 The next step is to attach consumers to these groups: consumers:
  - username: johndoe
    group_id: 1
    plugins:
      key-auth:
        key: john
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. We have the same results as before with two benefits. The first one is as I wrote above: when consumers move in and out, they change their permissions accordingly. The second benefit is that the limit count is shared among all consumers of a group.  Indeed, when you set a limit, you don't want each consumer to be rate limited at X requests per Y second; you want the group as a whole to share the limit. In this way, if a single consumer is very active, they will naturally cap the rate of other consumers who share the same group. Of course, you can set a limit on both a consumer and the group it belongs to. In this case, the lowest limit will apply first. consumers:
  - username: johndoe
    group_id: 2                        #1  
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane Move johndoe to group 2
Limit him individually curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get #1 johndoe hits the limit here, but janedoe now only has four requests left from this minute, as the former used one request Conclusion In this post, we implement rate limiting with Apache APISIX. We set the rate limit on a route and moved it to individual consumers. Then we moved it to consumer groups, so all consumers in a group share the same "pool". The complete source code for this post can be found on GitHub. To go further: Consumer
Consumer Group
Apache APISIX Hands-on Lab In my talk, “Evolving your APIs,” I mention that an API gateway is a Reverse Proxy "on steroids.” One key difference between the former and the latter is that the API Gateway is not unfriendly to business logic. The poster child is rate-limiting. Rate-limiting is an age-old Reverse Proxy feature focused on protecting against Distributed Denial of Service (DDoS) attacks. It treats all clients the same and is purely technical. In this day and age, most API providers offer different subscription tiers; the higher the tier, the higher the rate limit, and the more you pay incidentally. It's not technical anymore and requires to differentiate between clients. In this post, I want to detail how to do it with Apache APISIX. Note I take most of the material from the workshop . workshop Rate-limiting for the masses Apache APISIX offers no less than three plugins to rate limit requests: limit conn: limits the number of concurrent requests limit req: limits the number of requests based on the Leaky Bucket algorithm limit count: limits the number of requests based on a fixed time window limit conn : limits the number of concurrent requests limit conn limit req : limits the number of requests based on the Leaky Bucket algorithm limit req Leaky Bucket limit count : limits the number of requests based on a fixed time window limit count The limit-count plugin is a good candidate for this post. limit-count Let's configure the plugin for a route: routes:
  - uri: /get
    upstream:
      nodes:
        "http://httpbin.org:80": 1
    plugins:
      limit-count:                     #1
        count: 1                       #2
        time_window: 60                #2
        rejected_code: 429             #3
#END routes:
  - uri: /get
    upstream:
      nodes:
        "http://httpbin.org:80": 1
    plugins:
      limit-count:                     #1
        count: 1                       #2
        time_window: 60                #2
        rejected_code: 429             #3
#END Set the limit-count plugin Limit requests to one every 60 seconds Override the default HTTP response code, i.e., 503 Set the limit-count plugin limit-count Limit requests to one every 60 seconds Override the default HTTP response code, i.e. , 503 i.e. 503 At this point, we configured regular rate limiting. curl -v http://localhost:9080/get
curl -v http://localhost:9080/get curl -v http://localhost:9080/get
curl -v http://localhost:9080/get If we execute the second request before a minute has passed, the result is the following: HTTP/1.1 429 Too Many Requests
Date: Tue, 09 Jul 2024 06:55:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 241
Connection: keep-alive
X-RateLimit-Limit: 1                   #1
X-RateLimit-Remaining: 0               #2
X-RateLimit-Reset: 59                  #3
Server: APISIX/3.9.1

<html>
<head><title>429 Too Many Requests</title></head>
<body>
<center><h1>429 Too Many Requests</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html> HTTP/1.1 429 Too Many Requests
Date: Tue, 09 Jul 2024 06:55:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 241
Connection: keep-alive
X-RateLimit-Limit: 1                   #1
X-RateLimit-Remaining: 0               #2
X-RateLimit-Reset: 59                  #3
Server: APISIX/3.9.1

<html>
<head><title>429 Too Many Requests</title></head>
<body>
<center><h1>429 Too Many Requests</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html> Configured limit Remaining quota Waiting time in seconds before quota replenishment Configured limit Remaining quota Waiting time in seconds before quota replenishment Per-consumer rate limiting To configure per-consumer rate limiting, we first need to implement request authentication. APISIX offers many authentication plugins; we shall use the simplest one, key-auth . key-auth checks a specific HTTP request header - apikey by default. key-auth key-auth apikey Here's how we configure consumers: consumers:
  - username: johndoe                  #1
    plugins:
      key-auth:
        key: john                      #2
  - username: janedoe                  #1
    plugins:
      key-auth:
        key: jane                      #2 consumers:
  - username: johndoe                  #1
    plugins:
      key-auth:
        key: john                      #2
  - username: janedoe                  #1
    plugins:
      key-auth:
        key: jane                      #2 Users HTTP header request value Users HTTP header request value curl -H 'apikey: john' localhost:9080/get #1
curl -H 'apikey: jane' localhost:9080/get #2 curl -H 'apikey: john' localhost:9080/get #1
curl -H 'apikey: jane' localhost:9080/get #2 Authenticate as johndoe Authenticate as janedoe Authenticate as johndoe johndoe Authenticate as janedoe janedoe In general, you attach plugins to APISIX routes but can also attach them to consumers. We can now move the limit-count plugin. limit-count routes:
  - uri: /get
    upstream:
      nodes:
        "httpbin:80": 1
    plugins:
      key-auth: ~                      #1

consumers:
  - username: johndoe
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    plugins:
      key-auth:
        key: jane
      limit-count:
        count: 5                       #2
        time_window: 60
        rejected_code: 429
#END routes:
  - uri: /get
    upstream:
      nodes:
        "httpbin:80": 1
    plugins:
      key-auth: ~                      #1

consumers:
  - username: johndoe
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    plugins:
      key-auth:
        key: jane
      limit-count:
        count: 5                       #2
        time_window: 60
        rejected_code: 429
#END The route is only accessible to requests authenticating with key-auth johndoe has a lower limit count than janedoe. Did he forget to pay his subscription fees? The route is only accessible to requests authenticating with key-auth key-auth johndoe has a lower limit count than janedoe . Did he forget to pay his subscription fees? johndoe janedoe curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. Per-group rate limiting We never attach permissions directly to identities in Identity Management systems. It's considered bad practice because when a person moves around the organization, we need to add and remove permissions one by one. The good practice is to attach permissions to groups and set the person in that group. When the person moves, we change their group; the person loses permissions from the old group and gets permissions from the new group. People get their permissions transitively via their groups. transitively Apache APISIX offers an abstraction called a Consumer Group for this. Consumer Group Let's create two consumer groups with different rate limit values: consumer_groups:
  - id: 1
    plugins:
      limit-count:
        count: 1
        time_window: 60
        rejected_code: 429
  - id: 2
    plugins:
      limit-count:
        count: 5
        time_window: 60
        rejected_code: 429 consumer_groups:
  - id: 1
    plugins:
      limit-count:
        count: 1
        time_window: 60
        rejected_code: 429
  - id: 2
    plugins:
      limit-count:
        count: 5
        time_window: 60
        rejected_code: 429 The next step is to attach consumers to these groups: consumers:
  - username: johndoe
    group_id: 1
    plugins:
      key-auth:
        key: john
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane consumers:
  - username: johndoe
    group_id: 1
    plugins:
      key-auth:
        key: john
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. We have the same results as before with two benefits. The first one is as I wrote above: when consumers move in and out, they change their permissions accordingly. The second benefit is that the limit count is shared among all consumers of a group.  Indeed, when you set a limit, you don't want each consumer to be rate limited at X requests per Y second; you want the group as a whole to share the limit. In this way, if a single consumer is very active, they will naturally cap the rate of other consumers who share the same group. Of course, you can set a limit on both a consumer and the group it belongs to. In this case, the lowest limit will apply first. consumers:
  - username: johndoe
    group_id: 2                        #1  
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane consumers:
  - username: johndoe
    group_id: 2                        #1  
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane Move johndoe to group 2 Limit him individually Move johndoe to group 2 johndoe Limit him individually curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get #1 curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get #1 johndoe hits the limit here, but janedoe now only has four requests left from this minute, as the former used one request johndoe hits the limit here, but janedoe now only has four requests left from this minute, as the former used one request johndoe janedoe Conclusion In this post, we implement rate limiting with Apache APISIX. We set the rate limit on a route and moved it to individual consumers. Then we moved it to consumer groups, so all consumers in a group share the same "pool". The complete source code for this post can be found on GitHub . GitHub To go further: To go further: Consumer Consumer Group Apache APISIX Hands-on Lab Consumer Consumer Consumer Group Consumer Group Apache APISIX Hands-on Lab Apache APISIX Hands-on Lab

Advanced Rate Limiting with Apache APISIX: Optimizing API Gateway Performance

Ola: More Than Infrastructure - A New Gateway Connecting Web2 and Web3 Worlds

ওলা: অবকাঠামোর চেয়েও বেশি - ওয়েব2 এবং ওয়েব3 ওয়ার্ল্ডকে সংযুক্ত করার একটি নতুন গেটওয়ে

Ola: Mehr als Infrastruktur – Ein neues Gateway, das die Web2- und Web3-Welten verbindet

Ola: Más que infraestructura: una nueva puerta de enlace que conecta los mundos Web2 y Web3

Ola : Plus qu'une infrastructure - Une nouvelle passerelle reliant les mondes Web2 et Web3

ओला: बुनियादी ढांचे से कहीं अधिक - वेब2 और वेब3 दुनिया को जोड़ने वाला एक नया प्रवेशद्वार

Ola: 単なるインフラストラクチャ以上のもの - Web2 と Web3 の世界をつなぐ新しいゲートウェイ

Ola: 인프라 그 이상 - Web2와 Web3 세계를 연결하는 새로운 게이트웨이

Ola: Mais que infraestrutura – um novo gateway conectando os mundos Web2 e Web3

Ола: Больше, чем инфраструктура: новый шлюз, соединяющий миры Web2 и Web3

Ola: Altyapıdan Daha Fazlası - Web2 ve Web3 Dünyalarını Birleştiren Yeni Bir Ağ Geçidi

Ola: Hơn cả cơ sở hạ tầng - Một cổng mới kết nối thế giới Web2 và Web3

Ola：不仅仅是基础设施——连接 Web2 和 Web3 世界的新网关

Getting Started With Linux: Your Gateway to the Open-Source Realm

**TOKYO, Japan, May 8th, 2024/Chainwire/--**Slash Vision Labs is thrilled to introduce SVL Alpha-Base (’Alpha-Base’), an innovative addition to the SVL Portal tailored to offer SVL token stakers exclusive alpha opportunities from our esteemed partner projects. Alpha-Base represents a significant leap forward in our mission to empower and engage our community. By partnering with leading projects in the crypto space, Slash Vision Labs will create exclusive alpha opportunities for SVL token stakers, offering early access to token launches and potential airdrops. With three notable projects already onboarded and one more set to be announced in the coming days, Alpha-Base is poised to become the go-to destination for those seeking to stay ahead of the curve. Through SVL Alpha-Base, SVL token stakers will gain access to exclusive opportunities while our partner projects gain an active community already onboarded onto SVL. By bringing a vibrant and active community of SVL to their projects, our partners can benefit from increased engagement and participation in their platform and upcoming token launches. "Our mission with SVL Alpha-Base is to provide our community with the tools and opportunities needed to thrive in the ever-evolving crypto landscape. We aim to create a unified ecosystem that unlocks massive opportunities for every participant of the SVL ecosystem.”— Shinsuke Sato, Founder of Slash Vision Labs. Stay tuned for further updates and announcements as we prepare to launch SVL Alpha-Base and onboard many promising new projects. About Slash Vision Labs SVL (Slash Vision Labs) is pioneering the transformation of the cryptocurrency payments landscape with its innovative ecosystem, built on the Mantle Network. Embracing decentralization and community empowerment, SVL redistributes 100% of protocol fees back into the ecosystem, rewarding token stakers and fostering active participation. SVL's flagship products, Slash Card and Slash Payment, redefine the digital payments landscape. Slash Card, the first-ever compliant credit card in Japan, bridges fiat and crypto economies, offering unmatched convenience. Meanwhile, Slash Payment, a crypto-to-crypto swap payment solution, empowers over 4,000 merchants, processing over 200 million USD worth of crypto transactions. For media inquiries or further information, please contact: Masato Kato Business Development Slash Vision Labs hello@slash.vision Website | X | Discord | Medium | Whitepaper Contact Slash Team hello@slash.vision This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here. **TOKYO, Japan, May 8th, 2024/Chainwire/--**Slash Vision Labs is thrilled to introduce SVL Alpha-Base (’Alpha-Base’), an innovative addition to the SVL Portal tailored to offer SVL token stakers exclusive alpha opportunities from our esteemed partner projects. Alpha-Base represents a significant leap forward in our mission to empower and engage our community. By partnering with leading projects in the crypto space, Slash Vision Labs will create exclusive alpha opportunities for SVL token stakers, offering early access to token launches and potential airdrops. With three notable projects already onboarded and one more set to be announced in the coming days, Alpha-Base is poised to become the go-to destination for those seeking to stay ahead of the curve. Through SVL Alpha-Base, SVL token stakers will gain access to exclusive opportunities while our partner projects gain an active community already onboarded onto SVL. By bringing a vibrant and active community of SVL to their projects, our partners can benefit from increased engagement and participation in their platform and upcoming token launches. "Our mission with SVL Alpha-Base is to provide our community with the tools and opportunities needed to thrive in the ever-evolving crypto landscape. We aim to create a unified ecosystem that unlocks massive opportunities for every participant of the SVL ecosystem.”— Shinsuke Sato, Founder of Slash Vision Labs. "Our mission with SVL Alpha-Base is to provide our community with the tools and opportunities needed to thrive in the ever-evolving crypto landscape. We aim to create a unified ecosystem that unlocks massive opportunities for every participant of the SVL ecosystem.”— Shinsuke Sato, Founder of Slash Vision Labs. Stay tuned for further updates and announcements as we prepare to launch SVL Alpha-Base and onboard many promising new projects. About Slash Vision Labs SVL (Slash Vision Labs) is pioneering the transformation of the cryptocurrency payments landscape with its innovative ecosystem, built on the Mantle Network. Embracing decentralization and community empowerment, SVL redistributes 100% of protocol fees back into the ecosystem, rewarding token stakers and fostering active participation. SVL's flagship products, Slash Card and Slash Payment, redefine the digital payments landscape. Slash Card, the first-ever compliant credit card in Japan, bridges fiat and crypto economies, offering unmatched convenience. Meanwhile, Slash Payment, a crypto-to-crypto swap payment solution, empowers over 4,000 merchants, processing over 200 million USD worth of crypto transactions. For media inquiries or further information, please contact: Masato Kato Business Development Slash Vision Labs hello@slash.vision hello@slash.vision hello@slash.vision Website | X | Discord | Medium | Whitepaper Website Website X X Discord Discord Medium Medium Whitepaper Whitepaper Contact Slash Team hello@slash.vision This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here. This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here . here here

Slash Vision Labs Unveils SVL Alpha-Base: A New Gateway To Exclusive Alpha Opportunities

Lucas Hoffman, CTO at 0xProcessing, a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. Q: The cryptocurrency market is going through a big upswing again. Bitcoin recently reached a new high, and other cryptocurrencies are also doing well compared to last year. Has this affected the crypto processing market? How did the volume of payments change? This question is not about the dollar equivalent of TRX volume, which obviously went up just because the exchange rate grew sharply. 0x: The number of payments made through crypto payment gateways has been growing lately every year. Of course, when the price of Bitcoin goes up, more businesses become interested in accepting crypto payments. But even during the tough times for crypto in 2022-2023, we saw more people using crypto payment gateways. Our data shows that in the first quarter of 2021, over 200 thousand transactions went through 0xProcessing. By the end of the first quarter of 2022, even though Bitcoin's price dropped, we had already processed 1.5 million transactions. By the end of 2023, over 3.5 million transactions had been completed through 0xProcessing. By this April, 0x processed over 4.5 mln of transactions. The number of merchants has risen to 400+. This shows that more and more people want to use crypto for payments, both businesses offering it on their websites and users making the payments. Q: 0x was launched in 2020 supporting 5 blockchains and 15 coins. Now, it supports 13 blockchains and over 50 cryptocurrencies. Which blockchains are the most popular in B2C payment? Where do regular users have the most transactions? 0x: Among the most popular cryptocurrencies are BTC, ETH, BNB, DOGE, LTC, DASH, SOL, alongside stablecoins like USDT and DAI. When it comes to blockchains, users tend to favor networks with low fees, such as BNB Chain, TRON, and DOGE. Q: So, Bitcoin isn't the top choice for most merchants? 0x: Bitcoin holds a unique position. Due to its widespread use, merchants typically prioritize accepting Bitcoin payments. Consequently, despite its higher fees compared to other blockchains, Bitcoin still accounts for a significant share of crypto processing. According to our internal statistics, currently, transactions in BTC account for 26% of overall turnover through 0xProcessing. Q: What merchants are the main users of crypto payment gateways? 0x: Cryptoprocessing is particularly favored by merchants who operate globally, especially those in the virtual space, owing to its advantages in speed, low fees, and ability to handle international transactions. For example, VPN services, such as Eva VPN which operates globally and has hundreds of secure VPN servers around the world. Q: Why do businesses show interest in crypto payments despite the volatility of cryptocurrencies? 0x: Businesses such as gaming and betting platforms, subscription services, and global merchants seek fast electronic payments worldwide, beyond the confines of specific countries or regions. Their users require quick account replenishment, and crypto processing proves to be a much more convenient and faster method than traditional payment systems or bank transfers. The issue of cryptocurrency volatility in processing is not a problem anymore. Particularly, 0xProcessing addresses the volatility issue with its Volatility Risk Control System service. This service automatically converts crypto received as payment to stablecoins, safeguarding assets from market fluctuations. Merchants can choose the portion of crypto to convert into stablecoins and which share of the payment to retain as crypto. Q: Do merchants prefer immediate conversion to stablecoins upon receiving payments, or do they hold part of their assets in cryptocurrency? 0x: The preference for automatic conversion to stablecoins depends on market conditions. During bear markets, merchants tend to increase automatic conversion amounts to shield against cryptocurrency depreciation. Conversely, amidst recent bullish trends, the share of auto-conversion has notably declined. Merchants, akin to crypto investors, favor HODLing, anticipating enhanced profitability through the appreciation of accepted coins. Q: Can you compete with the large crypto processing companies in the market? 0x: In some cases, being affiliated with a major crypto exchange or belonging to a large holding can actually be detrimental to crypto processing. Crypto processing is inherently personal. Each merchant has unique needs and specific requests. A one-size-fits-all solution, like a generic product on a supermarket shelf, often falls short. Merchants require fast, simple, and cost-effective solutions tailored to their individual requirements. At 0xProcessing, we've embraced this personalized approach to client relationships. Our technical support team is available round-the-clock, ensuring prompt assistance. We take pride in our swift response times, with queries typically answered within 60 minutes. Additionally, our APIs are designed for easy customization, requiring no specialized programming knowledge, thus empowering merchants to configure them according to their preferences. Finally, the introduction of Web3 into crypto processing is our unique offer. Almost no one has anything like this on the market. Q: In 2021, 0xProcessing introduced Web3 wallet integration. How does this change crypto payment processing, and why is it considered more secure? 0x: With Web3 wallet integration, crypto payment processing becomes more streamlined and secure. This approach enables direct connection with users' Web3 wallets, enhancing security by minimizing intermediaries and facilitating seamless transactions directly from users' wallets. Lucas Hoffman, CTO at 0xProcessing, a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. Lucas Hoffman, CTO at 0xProcessing, a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. Lucas Hoffman, CTO at 0xProcessing , a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. 0xProcessing 0xProcessing Q: The cryptocurrency market is going through a big upswing again. Bitcoin recently reached a new high, and other cryptocurrencies are also doing well compared to last year. Has this affected the crypto processing market? How did the volume of payments change? This question is not about the dollar equivalent of TRX volume, which obviously went up just because the exchange rate grew sharply. Q: The cryptocurrency market is going through a big upswing again. Bitcoin recently reached a new high, and other cryptocurrencies are also doing well compared to last year. Has this affected the crypto processing market? How did the volume of payments change? This question is not about the dollar equivalent of TRX volume, which obviously went up just because the exchange rate grew sharply. 0x: The number of payments made through crypto payment gateways has been growing lately every year. Of course, when the price of Bitcoin goes up, more businesses become interested in accepting crypto payments. But even during the tough times for crypto in 2022-2023, we saw more people using crypto payment gateways. Our data shows that in the first quarter of 2021, over 200 thousand transactions went through 0xProcessing. By the end of the first quarter of 2022, even though Bitcoin's price dropped, we had already processed 1.5 million transactions. By the end of 2023, over 3.5 million transactions had been completed through 0xProcessing. By this April, 0x processed over 4.5 mln of transactions. The number of merchants has risen to 400+. This shows that more and more people want to use crypto for payments, both businesses offering it on their websites and users making the payments. Q: 0x was launched in 2020 supporting 5 blockchains and 15 coins. Now, it supports 13 blockchains and over 50 cryptocurrencies. Which blockchains are the most popular in B2C payment? Where do regular users have the most transactions? Q: 0x was launched in 2020 supporting 5 blockchains and 15 coins. Now, it supports 13 blockchains and over 50 cryptocurrencies. Which blockchains are the most popular in B2C payment? Where do regular users have the most transactions? 0x: Among the most popular cryptocurrencies are BTC, ETH, BNB, DOGE, LTC, DASH, SOL, alongside stablecoins like USDT and DAI. When it comes to blockchains, users tend to favor networks with low fees, such as BNB Chain, TRON, and DOGE. Q: So, Bitcoin isn't the top choice for most merchants? Q: So, Bitcoin isn't the top choice for most merchants? 0x: Bitcoin holds a unique position. Due to its widespread use, merchants typically prioritize accepting Bitcoin payments. Consequently, despite its higher fees compared to other blockchains, Bitcoin still accounts for a significant share of crypto processing. According to our internal statistics, currently, transactions in BTC account for 26% of overall turnover through 0xProcessing . 0xProcessing 0xProcessing Q: What merchants are the main users of crypto payment gateways? Q: What merchants are the main users of crypto payment gateways? 0x: Cryptoprocessing is particularly favored by merchants who operate globally, especially those in the virtual space, owing to its advantages in speed, low fees, and ability to handle international transactions. For example, VPN services, such as Eva VPN which operates globally and has hundreds of secure VPN servers around the world. Q: Why do businesses show interest in crypto payments despite the volatility of cryptocurrencies? Q: Why do businesses show interest in crypto payments despite the volatility of cryptocurrencies? 0x: Businesses such as gaming and betting platforms, subscription services, and global merchants seek fast electronic payments worldwide, beyond the confines of specific countries or regions. Their users require quick account replenishment, and crypto processing proves to be a much more convenient and faster method than traditional payment systems or bank transfers. The issue of cryptocurrency volatility in processing is not a problem anymore. Particularly, 0xProcessing addresses the volatility issue with its Volatility Risk Control System service. This service automatically converts crypto received as payment to stablecoins, safeguarding assets from market fluctuations. Merchants can choose the portion of crypto to convert into stablecoins and which share of the payment to retain as crypto. Q: Do merchants prefer immediate conversion to stablecoins upon receiving payments, or do they hold part of their assets in cryptocurrency? Q: Do merchants prefer immediate conversion to stablecoins upon receiving payments, or do they hold part of their assets in cryptocurrency? 0x: The preference for automatic conversion to stablecoins depends on market conditions. During bear markets, merchants tend to increase automatic conversion amounts to shield against cryptocurrency depreciation. Conversely, amidst recent bullish trends, the share of auto-conversion has notably declined. Merchants, akin to crypto investors, favor HODLing, anticipating enhanced profitability through the appreciation of accepted coins. Q: Can you compete with the large crypto processing companies in the market? Q: Can you compete with the large crypto processing companies in the market? 0x: In some cases, being affiliated with a major crypto exchange or belonging to a large holding can actually be detrimental to crypto processing. Crypto processing is inherently personal. Each merchant has unique needs and specific requests. A one-size-fits-all solution, like a generic product on a supermarket shelf, often falls short. Merchants require fast, simple, and cost-effective solutions tailored to their individual requirements. At 0xProcessing , we've embraced this personalized approach to client relationships. Our technical support team is available round-the-clock, ensuring prompt assistance. We take pride in our swift response times, with queries typically answered within 60 minutes. Additionally, our APIs are designed for easy customization, requiring no specialized programming knowledge, thus empowering merchants to configure them according to their preferences. 0xProcessing 0xProcessing Finally, the introduction of Web3 into crypto processing is our unique offer. Almost no one has anything like this on the market. Q: In 2021, 0xProcessing introduced Web3 wallet integration. How does this change crypto payment processing, and why is it considered more secure? Q: In 2021, 0xProcessing introduced Web3 wallet integration. How does this change crypto payment processing, and why is it considered more secure? 0x: With Web3 wallet integration, crypto payment processing becomes more streamlined and secure. This approach enables direct connection with users' Web3 wallets, enhancing security by minimizing intermediaries and facilitating seamless transactions directly from users' wallets.

0xProcessing: BTC Accounts for 26% of All Transactions Through Payment Gateway

The Open Worldwide Application Security Project is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of IoT, system software and web application security. The OWASP provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 - 2021 is the published result of recent research based on comprehensive data compiled from over 40 partner organizations. -- OWASP website The OWASP regularly publishes a Top 10 vulnerability report. The report targets vulnerabilities in web applications. In this post, I'd like to describe how to fix some of them via the . Apache APISIX API Gateway The OWASP Top 10 2021 In 2021, the report mentions: A01:2021-Broken Access Control A02:2021-Cryptographic Failures A03:2021-Injection A04:2021-Insecure A05:2021-Security Misconfiguration A06:2021-Vulnerable and Outdated Components A07:2021-Identification and Authentication Failures A08:2021-Software and Data Integrity Failures A09:2021-Security Logging and Monitoring Failures A10:2021-Server-Side Request Forgery For more details, please check the complete . report Fixing a vulnerability depends on its exact nature. For example, fixing is process-driven, requiring discipline in managing versions and retiring older ones. Some, however, are technical and only require proper configuration in the reverse proxy or API Gateway, , . Vulnerable and Outdated Components e.g. Server Side Request Forgery Nobody cares about security Security is a touchy subject because hardening security doesn't bring any value to the business. Career-driven managers won't care about security as they won't be able to showcase they increased the company's profit by X% on their next yearly evaluation. Unless the board considers security seriously, chances are nobody will care. For this reason, most organizations implement checkbox-based security, aka plausible deniability. If you're interested in implementing security properly, I've written some thoughts in a previous blog post: . Treat security as a risk All in all, securing applications will not get a lot of budget, if any. Hence, we must be smart about it and search for an existing component. Fortunately, the OWASP offers an out-of-the-box configuration to handle the Top 10, which is fixable via a configuration named . Unfortunately, it targets ModSecurity: Core Rule Set ModSecurity, sometimes called Modsec, is an open-source web application firewall (WAF). Originally designed as a module for the Apache HTTP Server, it has evolved to provide an array of Hypertext Transfer Protocol request and response filtering capabilities along with other security features across a number of different platforms including Apache HTTP Server, Microsoft IIS and Nginx. It is free software released under the Apache license 2.0. -- ModSecurity on Wikipedia While it's theoretically possible to configure Nnginx via Apache APISIX configuration, there's another more straightforward way. The OWASP Core Ruleset and Coraza The description of the Core Ruleset is pretty relevant to our needs: The OWASP® ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. The CRS provides protection against many common attack categories, including: SQL Injection (SQLi) Cross Site Scripting (XSS) Local File Inclusion (LFI) Remote File Inclusion (RFI) PHP Code Injection Java Code Injection HTTPoxy Shellshock Unix/Windows Shell Injection Session Fixation Scripting/Scanner/Bot Detection Metadata/Error Leakages -- OWASP® ModSecurity Core Rule Set website OWASP also provides , a port of ModSecurity available as a Go library. is built on top of Coraza and implements the , which specifies a set of Wasm interfaces for proxies. Finally, Apache APISIX offers proxy-wasm integration. Coraza Coraza Proxy Wasm proxy-wasm ABI Putting it all together Let's sum up: The OWASP provides a list of the Top 10 web security vulnerabilities It implements them for ModSecurity via the Core Ruleset Coraza is a port of ModSecurity, available as a proxy-wasm implementation We can configure Apache APISIX with sane and secure defaults this way. Let's do it. First things first: Coraza isn't part of the Apache APISIX distribution. Yet, it's straightforward to add it here with Docker: FROM apache/apisix:3.8.0-debian

ENV VERSION 0.5.0                                                           #1
ENV CORAZA_FILENAME coraza-proxy-wasm-${VERSION}.zip                        #1

ADD https://github.com/corazawaf/coraza-proxy-wasm/releases/download/$VERSION/$CORAZA_FILENAME . #2

USER root                                                                   #3

RUN <<EOF

  apt-get install zip -y                                                    #4
  unzip $CORAZA_FILENAME -d /usr/local/apisix/proxywasm
  rm $CORAZA_FILENAME
  apt-get remove zip -y
  chown -R apisix:apisix /usr/local/apisix/proxywasm

EOF

USER apisix                                                                 #5 Define variables for better maintainability Get the Coraza Wasm release In recent APISIX versions, the user is to harden security. As we need to install packages, we must switch to . apisix root Install as it's not installed, unzip the downloaded archive, remove the archive, uninstall , and change the owner of the extracted folder unzip unzip Switch back to user apisix The next step is configuring APISIX itself to use the Coraza Wasm plugin. wasm:
  plugins:
    - name: coraza-filter                                                   #1
      priority: 7999                                                        #2
      file: /usr/local/apisix/proxywasm/coraza-proxy-wasm.wasm              #3 Filter's name set in Wasm code Set the highest priority so it runs before any other plugin Path to the extracted file, see the above Dockerfile Finally, we can assign the plugin to routes or set it as a global rule to apply to every route. I'm using static configuration: global_rules:
  - id: 1
    plugins:
      coraza-filter:                                                        #1
        conf:
          directives_map:                                                   #2
            default:
              - SecDebugLogLevel 9                                          #3
              - SecRuleEngine On                                            #4
              - Include @crs-setup-conf                                     #5
              - Include @owasp_crs/*.conf                                   #6
          default_directives: default                                       #7 Configure the plugin now that it's available coraza-filter Define configurations. Here, we define a single one, , but we could define several and use different ones in different routes default Increase the log level to see what happens in logs Switch on the engine Use Coraza setup Use all rules. We could pick and choose the ones we want for more fine-grained control Use the configuration defined above default We proceed to define routes to to test our setup. Let's call the route to : https://httpbin.org/ /get curl localhost:9080?user=foobar The response is as expected: {
  "args": {
    "user": "foobar"
  }, 
  "headers": {
    "Accept": "*/*", 
    "Host": "localhost", 
    "User-Agent": "curl/8.4.0", 
    "X-Amzn-Trace-Id": "Root=1-65b9fa13-75900dc029e156ec764ae204", 
    "X-Forwarded-Host": "localhost"
  }, 
  "origin": "192.168.65.1, 176.153.7.175", 
  "url": "http://localhost/get?user=foobar"
} Now, let's try to send JavaScript in the query string. There's no way this request is expected server-side, so our infrastructure should protect us from it. curl 'localhost:9080?user=<script>alert(1)</script>' The response is a 403 HTTP status code. If we look at the log, we can see the following hints: Coraza: Warning. XSS Attack Detected via libinjection [file "@owasp_crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf"]
Coraza: Warning. NoScript XSS InjectionChecker: HTML Injection
Coraza: Warning. Javascript method detected
Coraza: Access denied (phase 1). Inbound Anomaly Score Exceeded in phase 1 Coraza did the job! Conclusion Most organizations don't incentivize for security. Hence, we need to be smart about it and use existing components as much as possible. We can harden Apache APISIX against the OWASP Top 10 by using Coraza and the Core Ruleset. To go further: OWASP Security Top 10 OWASP ModSecurity Core Ruleset OWASP Coraza WAF APISIX - Integrate with Coraza The complete source code for this post can be found on . GitHub Originally published at on February 4th, 2024 A Java Geek

How to Address Web Vulnerabilities With Apache APISIX API Gateway

Apache APISIX API গেটওয়ে দিয়ে কীভাবে ওয়েব দুর্বলতাগুলি মোকাবেলা করবেন

So beheben Sie Web-Schwachstellen mit dem Apache APISIX API Gateway

Cómo abordar las vulnerabilidades web con Apache APISIX API Gateway

Comment remédier aux vulnérabilités Web avec Apache APISIX API Gateway

अपाचे एपीआईएसआईएक्स एपीआई गेटवे के साथ वेब कमजोरियों को कैसे संबोधित करें

Apache APISIX API ゲートウェイを使用して Web の脆弱性に対処する方法

Apache APISIX API 게이트웨이를 사용하여 웹 취약점을 해결하는 방법

Como resolver vulnerabilidades da Web com Apache APISIX API Gateway

Как устранить веб-уязвимости с помощью API-шлюза Apache APISIX

Apache APISIX API Ağ Geçidi ile Web Güvenlik Açıkları Nasıl Giderilir?

Cách giải quyết các lỗ hổng web bằng cổng API APISIX của Apache

如何使用 Apache APISIX API 网关解决 Web 漏洞

Especially when talking about , many articles and videos focus on an architectural element that, in their opinion, is absolutely necessary for building such kinds of applications: . microservices API Gateways Yes, they are actually useful, but they are not the solution to every architectural problem. In this article, we will learn what API Gateways are, their pros and cons, why you should distinguish them from Load Balancers, and more. What is an API Gateway? Imagine that your application is made of several web services and APIs. Each of them will be deployed on a separate host, therefore having a different URL. While it can be helpful for internal development - you have a clear separation of operations available in your system - it can become cumbersome for the developers who have to integrate all those endpoints in their application. That’s where API Gateways come into play: they to uniform the access to your system. add a sort of in front of your set of APIs façade Say that you’ve built a Hotel booking system that is made of 3 services: , deployed at BookingAPI https://bookings.mycompany.org/api , deployed at SearchAPI https://mycompany.org/search/api , deployed at (notice the ) DiscountAPI https://discounts.mycompany.org/v1/api v1 By adding an API Gateway, you can hide these APIs behind a single host, like , mapping the route path to the original services’ URLs. https://api.mycompany.org/ As with everything in the world, there are advantages and disadvantages. Let’s learn! 🔥 Advantages of an API Gateway API Gateways have lots of advantages. It’s not a coincidence that they are being used in many architectures. Let’s see some of the best characteristics of an API Gateway. Internal API security Since your internal APIs are hidden behind an API Gateway, you make them discoverable by intruders who might want to access your systems and data. less Let’s go back to the Hotel Booking system in our example. External users will only see the host without knowing the structure of the internal API services. This . api.mycompany.com reduces the attack surface You can also by adding them to the API Gateway and have them applied to all the APIs behind the Gateway. centralize Access Control Policies Finally, you can and analyze the traffic to spot unusual behavior in a single place. monitor all the incoming requests Reduced complexity Some concerns are common to all the APIs within the same system, such as , , and . rate limiting throttling access control With API Gateways, you can for such common concerns in a single point. For example, once you have defined some rate limiting policies on your Gateway, you can have the same settings automatically applied to every internal API endpoint (well, not “physically” applied to the internal APIs, but since the Gateway blocks some incoming requests, they will not reach the internal systems as well). centralize the settings API Gateways also help with : since you have all the internal services listed in the API Gateway, just by looking at its configurations, you can see the list of the deployed APIs and their hostname. service documentation Flexibility Since API Gateways act as a façade in front of other services, you can integrate services that work with . different protocols or formats For example, you can have one service that exposes GraphQL APIs, another one that works with GRPC, and have them all exposed as REST APIs using the API Gateway as a wrapper/converter to and from such formats. Hiding the actual API endpoints behind a Gateway also allows you to , which is a technique that will enable you to aggregate the results from different internal API calls and return the caller only the final result (as opposed as making the client call each single service and compose the result afterwards). implement API Composition Enhanced performance Depending on the vendor, you can have different tools to improve the overall performance. For example, you can to get quicker response times, or you can apply uniformed . cache responses data compressions Some vendors allow you to have multiple instances of the same service available behind the API Gateway, acting as a sort of Load Balancer. Another powerful technique you can implement is . In a simple architecture, if you have to communicate securely with three systems to aggregate the result, you have to validate the SSL connection three times. With , you can move these operations on the API Gateway component and avoid doing that in all the other services, making the application more performant. SSL Termination SSL Termination Disadvantages Single point of failure Since we placed an API Gateway in front of all the other API applications, all the external communication passes through the API Gateway. This means that , even though the single APIs are still up and running. if the API Gateway is unavailable, the whole system becomes unavailable as well So, when using an API Gateway: : an error in the configurations can have consequences on the whole system; Beware of the settings Ensure that the Gateway is capable of handling the incoming load of requests: if the API Gateway cannot cope with the number of incoming requests, it may become unavailable and make the whole system offline. Ensure that you have some (see the previous point). protection against DDoS attacks Increased latency An API Gateway is an in the API processing: when a client wants to call an API application, all requests must first pass through the API Gateway, which, in turn, will call the internal API. additional hop This processing, this routing, adds some network latency. Maybe it’s not noticeable, but it depends on the Gateway you choose, the underlying infrastructure, and the processing done by the Gateway. Vendor Lock-in Once you have deployed and configured an API Gateway, moving to another vendor might be difficult. You risk vendor lock-in, with all the consequences: if the price goes up or if they remove some functionalities that you need, you will have to come up with a solution to migrate that specific part of your infrastructure to another vendor. It might not be so easy - some straightforward ways to mitigate the risk are to and to that validate the routing and the functionalities. make your systems platform agnostic create e2e tests API Gateway VS Load Balancer Some people I know and the authors of some articles I read use API Gateway and Load Balancer as synonyms. Let me get it straight: they are not the same! Yes, they both are components that work with incoming requests. But they serve two totally different purposes. While Load Balancers “just” spread incoming requests across multiple instances of the same service, API Gateways act as a façade in front of different types of services. They are two totally different components of an architecture. Some vendors provide both functionalities, while others don’t. So, keep the two meanings distinct, and try to use the correct wording. API Gateway vendors comparison Here is a list of some API Gateway vendors’ prices, pros, and cons. Notice: . The info in this list comes primarily from their official documentation and, in some cases, from other resources that compare such products. I have yet to try all these vendors : it’s an Open Source product that provides features such as authentication, rate limiting, logging, caching, and more. It is written in Lua and runs on top of Nginx. Kong Price: Kong offers free community and paid enterprise editions. Pros: Kong is easy to install and configure, supports many plugins and integrations, and has a large and active community. Cons: Kong may have performance issues when handling large volumes of traffic, requires Nginx as a dependency, and has limited support for GraphQL, which is available only for the enterprise edition. : it’s a lightweight API Gateway written in Go. It offers API analytics, a developer portal, a dashboard, security, and other features. It can be deployed on-premises, in the cloud, or as a hybrid. Tyk Price: Tyk offers a 5-week free trial and four payment tiers. The Starter edition costs $600 per month for up to 10 million API calls. Pros: Tyk is fast, scalable, and flexible and has a rich set of features and plugins. Cons: Even though Tyk is open source, it has no free tier. : an API Gateway that is based on Express.js. It provides a single package with dynamic routing, access control, and API management. It is written in JavaScript. Express Gateway Price: Express Gateway is free and open source. Pros: Express Gateway is simple to use and customize, supports the Node.js ecosystem and middleware, and can be easily extended with plugins. Cons: Express Gateway may not be suitable for complex scenarios, as it lacks some advanced features such as caching (which is in the Medium Term roadmap). : an open-source API Gateway that is part of the Netflix OSS stack. It provides dynamic routing, resiliency, security, and monitoring for microservices. It is written in Java and can be integrated with other Netflix components. Zuul Price: Zuul is free and open source. Pros: Zuul is robust, reliable, and battle-tested by Netflix and supports filters for request processing. Cons: Zuul has limited documentation. : it offers features such as a developer portal, Gateway, policies, throttling, caching, and more. Azure API Management Price: Azure API Management offers a free tier and several paid tiers. The paid tiers start from $0.07 per hour for the Developer tier and go up to $3.83 per hour for the Premium tier. Pros: Azure API Management is easy to integrate with other Azure services, supports multiple protocols and formats, and has a rich set of features and policies. Cons: Azure API Management may have a complex pricing model, and it requires Azure Active Directory for authentication. : It provides complete lifecycle API management, from design and development to security and analytics. Amazon API Gateway Price: Amazon API Gateway offers a free tier and a pay-as-you-go model. The pay-as-you-go model charges per million API calls received, plus data transfer and caching fees. Pros: Amazon API Gateway is scalable, reliable, and secure; it supports serverless architectures and WebSocket APIs. Cons: Amazon API Gateway may have a steep learning curve for beginners, requires AWS Lambda for custom logic, and has limited documentation and support. It has a complex pricing tier. : It supports OpenAPI Specification v2 and gRPC APIs. Google Cloud API Gateway Price: Google Cloud API Gateway offers tiers based on the number of API calls. From 0 to 2 million calls, the service is free. From 2 million to 1 billion calls, you pay $3.00 per million API calls, while from 1 billion on, you pay $1.5 per million API calls. Pros: Google Cloud API Gateway is easy to use and deploy, supports multiple authentication methods and protocols, and integrates well with other Google Cloud services. Cons: It has limited plugins and integrations. Further readings It’s not the first time we talked about API Gateways in this blog: in fact, there’s an old article where I shared some things I learned about API Gateways the first time I heard about them: 🔗 API Gateways - an overview | Code4IT We also learned how to use Azure API Management to integrate the API Gateways product provided by Azure to organize some .NET APIs. 🔗 How to create an API Gateway using Azure API Management | Code4IT This article taught us that API Gateways are different from Load Balancers. Do you know what are some types of Load Balancers and why you should care? 🔗 Davide’s Code and Architecture Notes - L4 vs L7 Load Balancer | Code4IT Wrapping up Beware those who say that API Gateways are «the best thing to add to a microservice architecture»! As we learned, there are some downsides, too. Always make sure that the products and the components you choose fit your necessities and that you learn when something is for you. not I hope you enjoyed this article! Let’s keep in touch on or ! 🤜🤛 Twitter LinkedIn Happy coding! 🐧 Also published . here

Stories, News & Mentions about GATEWAY

Gateway’s Stories on HackerNoon

Gateway's News & Mentions