API Meetup Security APIs and Microservices

Hello API Enthusiasts!

Another API Meetup is on its way. You probably know we have our conference in September — https://apidays.co/barcelona and we want to leverage the momentum to give some sprint to our regular meetup.

P.S: Do you want to come to the conference, but the price is high? We have discounted tickets for you — just get in touch with us and we will figure out something.

This time we will focus on Security for APIs and Microservices, with talks from some of the speakers of the event that have been kind enough to extend their staying to come talk to us.

Agenda:
18:30h - Open Doors

19:00h - Welcome note

19:10h - Liran Tal - Developer Advocate @ Snyk

Stranger Danger: Finding Security Vulnerabilities Before They Find You!

Open source modules on the NPM ecosystem are undoubtedly awesome. However, they also represent an undeniable and massive risk. You’re introducing someone else’s code into your system, often with little or no scrutiny. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user's data. This talk will use a sample application, Goof, which uses various vulnerable dependencies, which we will exploit as an attacker would. For each issue, we'll explain why it happened, show its impact, and – most importantly – see how to avoid or fix it.

19:50h - Waleed Ashraf - Node.js Developer @ relayr

Adopting AsyncAPI for Documentation and Validation of Async Communication

Microservices and Event-Driven Architecture are being adopted in many companies nowadays. As the number of services increases, it becomes necessary to document and standardize the communication between services.
At Relayr GmbH we have dozens of services written in Node.js, Scala and other languages also. These services communicate with each other over different channels including Kafka and MQTT on many topics and messages types. We had JSON schemas defined within services to validate and test the payload. It was hard for everyone to keep track of all the types of messages, their payload and to know which types of messages each service is publishing/consuming.
We started using AsyncAPI to document every message including their payload, required and optional fields. AsyncAPI became the source of truth of all the Async communication between services. We came up with asyncapi-validator to validate every message at run time using AsyncAPI schema definition.
This talk will be about how we used AsyncAPI for better documentation and as the source of truth. We’ll also see, how we used the asyncapi-validator to validate messages using AsyncAPI schema definition.