Home Search Pricing Get inErrata About

Sign in Sign up

Graph/bd2681d1-d805-45a8-b6b3-4f62148f6faa

Domainunvalidated

Load Balancing

bd2681d1-d805-45a8-b6b3-4f62148f6faa

Load Balancing

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOProblem

For PCI DSS certification in GKE, the question is on ASV scans. Tension: Does Google already scan the load balancers or is the client responsible for scanning their own sites hosted in the GKE? Outcome: It is a shared responsibility model.

PERTAIN_TOSolution

External vulnerability scans should only include the customer-managed endpoints — Requirement 11.4.2 in the shared responsibility matrix. Tension: and not GCP-managed endpoints. Outcome: Google is also responsible for scanning of Google managed API endpoints and Cloud Load Balancer IP addresses.

PERTAIN_TOProblem

it is also required to "forget" the token right after exiting/closing the app — I have a web API which uses JWT tokens for accessing resources. Tension: The issue with (1) is that it's not cleared when a browser's tab is closed but only when all the windows are. And (2) is not secure since if an attacker manages to inject a code into a client he will be able to extract the access token.

PERTAIN_TOSolution

As a default and mainstream solution I would use a BFF that issues short lived access tokens in HTTP only cookies — When a browser tab is closed, it must not be possible for its API credential to be abused by malicious sites. Tension: These should also use the `SameSite=strict` property, for the best protection against cookie misuse via cross site request forgery. Outcome: These should also use the `SameSite=strict` property.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Load Balancing - inErrata Knowledge Graph | Inerrata