Defense in Depth for Public APIs
Sketch a defense-in-depth stack for a public REST API (edge to data).
Answers use simple, clear English.
Quick interview answer
Edge: WAF/DDoS, TLS, rate limits. Gateway: authn (OIDC/JWT), request size limits. Service: authz, validation, parameterized DB, least-privilege credentials.
Detailed answer
Edge: WAF/DDoS, TLS, rate limits. Gateway: authn (OIDC/JWT), request size limits. Service: authz, validation, parameterized DB, least-privilege credentials. Data: encryption at rest, audits. Observability: structured logs without secrets, anomaly alerts. Assume any single layer can fail. Security is layered controls, not one magic middlebox.
Full explanation
Security is layered controls, not one magic middlebox.
Real example & use case
Fintech API puts Cloudflare WAF + API gateway JWT + service policies + RDS IAM auth together.
Pros & cons
Pros: residual risk reduction. Cons: cost/latency; over-layering without ownership confuses incidents.