Multifocal review on testing tools and API security strategies in microservices - Mendes, Ian José Soares; Rodrigues, Lyanderson S.; Sousa, Rubens A. da S.; Santos, Ismayle de S. (Companion Proceedings of the Brazilian Symposium on Cybersecurity (SBSeg); 2025: Companion Proceedings of the 25th Brazilian Symposium on Cybersecurity, 2025)
Communication in microservice architectures has become increasingly common, requiring attention to security testing to ensure the quality of APIs. This study, through a multifocal review, investigated security tools and strategies applied to API development. Fifty articles from white literature and 270 from gray literature were analyzed. The most cited tools were RESTest (6), OWASP ZAP (6) and Postman (4). Among the strategies, Spring Security (93), JWT (81) and API Gateway (37) stood out. The main tests involved input validation (20), vulnerability detection (19) and authentication/authorization (14), with a focus on mitigating threats such as SQL Injection (11), configuration flaws (10) and OWASP Top Ten (8).