Legacy API Authentication Fix

Designed and deployed serverless function to fix outdated authentication

Mitigated auth bypass

Set up L7 API Schema Validation

Gained visibility

Frictionless migration for client authenticaion

Caused no downtime

Overview

A banking REST API authentication service supported a legacy OAuth flow which served millions of daily requests on its auth endpoint. Development team could not deliver a framework upgrade on time, without causing major service disruption. The legacy flow presented an auth bypass vulnerability, and also made our Cloudflare API Shield implementation unusable. I created a workaround fix using Cloudflare Workers to serve a small script on the edge.

Key Activities

Manually created a swaggerfile for all public endpoints to use for validation
Implemented Cloudflare’s API Shield and noticed the Oauth issue
Used Cursor to create a small and efficient script that would detect legacy auth requests, and rewrite them to fit the Schema Validation rules (i.e the newer flow) before they reach the endpoint.
Collaborated with Dev, QA and DevOps teams to stress test it in a Sandbox environment.
Successfully deployed to production as a Cloudflare Worker