[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eLast-mile security is crucial for protecting backend services from direct attacks, preventing developers from bypassing API proxies to reach backend URLs.\u003c/p\u003e\n"],["\u003cp\u003eClient TLS/SSL, also known as mutual authentication, is the primary method for ensuring last-mile security between API proxies and backend services.\u003c/p\u003e\n"],["\u003cp\u003eOutbound authentication, such as using API keys or OAuth client credentials, can be implemented to secure backend services, with API keys stored in key/value maps.\u003c/p\u003e\n"],["\u003cp\u003eOAuth client credentials offer a revocable layer of security compared to API keys, and require the backend to be capable of issuing and validating access tokens.\u003c/p\u003e\n"],["\u003cp\u003eSAML assertions can also be used to secure outbound XML requests, allowing backend services to authenticate and authorize requests originating from API proxies.\u003c/p\u003e\n"]]],[],null,["# Last-mile security\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nLast-mile security protects the backend services that are proxied by API Services. The primary\ngoal of last-mile security is to prevent so-called \"end-run\" attacks, where an app developer\ndiscovers the URL for a backend service and bypasses any API proxies to directly hit the backend\nURL.\n\nFollowing are the primary options for setting up last-mile security:\n\n- Client TLS/SSL\n- Outbound authentication\n\nClient TLS/SSL\n--------------\n\nThe primary mechanism for securing the last-mile is client TLS/SSL, which is also known as\n'mutual authentication'.\n\nSee [Options for configuring TLS](/apigee/docs/api-platform/system-administration/options-configuring-tls).\n\nOutbound authentication\n-----------------------\n\nLast-mile security can also be enforced by requiring the API proxy to present a credential to\nthe backend service.\n\nFor example, you may wish to have an API proxy present an API key to your backend service. You\ncould also have an API proxy obtain and present a OAuth client credentials access token.\n\n### API key\n\nAPI keys can be applied to outbound requests from API proxies to backend services. This\nassumes that the backend service is an API that is capable of issuing and validating API\nkeys.\n\nIf you do set up an API proxy to present an API key on outbound requests, you must store the\nAPI key in a place where it can be retrieved by the API proxy at runtime. One location available\nfor storing API keys is a key/value map. See [Key Value Map Operations\npolicy](/apigee/docs/api-platform/reference/policies/key-value-map-operations-policy).\n\nYou can use the AssignMessage policy type to add the API key as an HTTP header, query\nparameter, or payload element to the outbound request. See [Assign Message policy](/apigee/docs/api-platform/reference/policies/assign-message-policy).\n| **Best practice:** To avoid exposing API keys over network, always configure server-side TLS/SSL on your backend services for outbound transactions that use API keys\n\n### OAuth client credentials\n\nOAuth client credentials can be used to add a layer of revocability to API keys. If your\nbackend services support OAuth client credentials, you can configure an API proxy to present a\nclient credentials access token for each request.\n\nThe API proxy must be configured to perform a callout to obtain the access token from your\ntoken endpoint. The API proxy is also required to cache the access token, to prevent it from\nobtaining a new access token for each call.\n| **Warning:** Your backend services must be capable of issuing and validating access tokens using the client credentials grant type for this to work.\n|\n| Always configure server-side TLS/SSL on your backend services for transactions that use\n| access tokens.\n\nA number of approaches can be used to implement outbound client credentials.\n| **Sample:** A working outbound OAuth sample that uses client credentials is implemented in the [Outbound\n| OAuth sample](https://github.com/apigee/api-platform-samples/tree/master/sample-proxies/outbound-oauth) on GitHub.\n\nYou can modify this sample to call your token endpoint to obtain an access token. This sample\nuses JavaScript to attach the token to the outbound request as an HTTP Authorization header. You\ncould also use [Assign\nMessage policy](/apigee/docs/api-platform/reference/policies/assign-message-policy) for this purpose.\n\n### SAML\n\nThe GenerateSAMLAssertion policy type can be used to attach a SAML assertion to an outbound\nXML request message, from the API proxy to a backend service. This enables the backend service to\nperform authentication and authorization on requests received from API proxies.\n\nSee [SAML Assertion\npolicies](/apigee/docs/api-platform/reference/policies/saml-assertion-policy)."]]
