api-security

name	api-security
description	API security best practices and common vulnerability prevention. Enforces security checks for authentication, input validation, SQL injection, XSS, and OWASP Top 10 vulnerabilities. Use when building or modifying APIs.

API Security

API_SECURITY_MASTERY::[OWASP_TOP10+AUTH_PATTERNS+INPUT_VALIDATION+INJECTION_PREVENTION]→SECURE_BY_DESIGN

---

AUTHENTICATION & AUTHORIZATION

AUTH_MANDATE::[
  ALWAYS::explicit_authentication_required[no_endpoints_without_auth],
  PATTERN::decorator_or_middleware[enforce_before_handler],
  TOKENS::JWT_with_expiration[industry_standard],
  AUTHORIZATION::check_permissions_not_just_identity[who≠what_can_do]
]

EXAMPLE_AUTH_CHECK::
  # Good: Authentication + Authorization
  @app.delete("/api/users/{user_id}")
  @require_auth
  async def delete_user(user_id: str, request: Request):
      current_user = get_current_user(request)

      # Authorization check
      if not current_user.is_admin and current_user.id != user_id:
          raise HTTPException(status_code=403, detail="Forbidden")

      await delete_user_by_id(user_id)

JWT_PATTERN::[
  create::payload[sub, exp, iat]+jwt.encode(SECRET_KEY, algorithm="HS256"),
  verify::jwt.decode→catch[ExpiredSignatureError, InvalidTokenError]→401,
  expiration::short_lived[1hour_access, 7day_refresh]
]

---

INPUT VALIDATION

VALIDATION_MANDATE::[
  NEVER::trust_user_input,
  ALWAYS::validate_with_schema[Pydantic, Zod, Joi],
  TYPES::enforce_strict[string_length, numeric_range, email_format, regex_patterns],
  SANITIZE::remove_dangerous_chars[<script>, SQL_keywords, path_traversal]
]

EXAMPLE_VALIDATION::
  from pydantic import BaseModel, Field, validator

  class CreateUserRequest(BaseModel):
      username: str = Field(..., min_length=3, max_length=50, regex="^[a-zA-Z0-9_]+$")
      email: str = Field(..., regex=r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$")
      age: int = Field(..., ge=0, le=150)

      @validator("username")
      def no_admin_keyword(cls, v):
          if "admin" in v.lower():
              raise ValueError("Username cannot contain 'admin'")
          return v

---

SQL INJECTION PREVENTION

SQL_INJECTION_DEFENSE::[
  ALWAYS::parameterized_queries[NEVER_string_concatenation],
  ORM::use_query_builders[SQLAlchemy, Prisma, TypeORM],
  ESCAPE::parameters_automatically_escaped,
  VALIDATE::input_before_query[whitelist_allowed_values]
]

GOOD_VS_BAD::[
  BAD::"SELECT * FROM users WHERE id = '" + user_id + "'",  # VULNERABLE
  GOOD::"SELECT * FROM users WHERE id = ?",  # Parameterized
  GOOD::db.query("SELECT * FROM users WHERE id = :id", {id: user_id})  # Named params
]

---

XSS PREVENTION

XSS_DEFENSE::[
  OUTPUT_ENCODING::escape_html_entities[<, >, &, ", '],
  CSP::Content_Security_Policy_headers[restrict_script_sources],
  SANITIZE::user_generated_content[DOMPurify, bleach],
  FRAMEWORK_AUTO_ESCAPE::React_Angular_Vue[default_protection]
]

CSP_HEADER::
  Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com; object-src 'none'

---

OWASP TOP 10 CHECKLIST

TOP_10_VULNERABILITIES::[
  A01_Broken_Access_Control::[verify_permissions, enforce_least_privilege, deny_by_default],
  A02_Cryptographic_Failures::[encrypt_sensitive_data, HTTPS_only, strong_algorithms],
  A03_Injection::[parameterized_queries, input_validation, escape_output],
  A04_Insecure_Design::[threat_modeling, security_by_design, principle_of_least_privilege],
  A05_Security_Misconfiguration::[secure_defaults, disable_debug_in_prod, update_dependencies],
  A06_Vulnerable_Components::[npm_audit, dependency_scanning, keep_updated],
  A07_Auth_Failures::[multi_factor_auth, rate_limiting, secure_session_management],
  A08_Data_Integrity::[verify_signatures, integrity_checks, secure_CI/CD],
  A09_Logging_Failures::[log_security_events, protect_logs, alert_on_anomalies],
  A10_SSRF::[validate_URLs, whitelist_destinations, network_segmentation]
]

---

RATE LIMITING

RATE_LIMIT_PATTERN::[
  AUTH_ENDPOINTS::5_requests_per_minute[login, register, reset_password],
  API_ENDPOINTS::100_requests_per_minute_per_user,
  IMPLEMENTATION::[Redis, express-rate-limit, Django_ratelimit],
  RESPONSE::429_Too_Many_Requests[Retry-After_header]
]

---

SECRETS MANAGEMENT

SECRETS_RULES::[
  NEVER::hardcode[API_keys, passwords, tokens, certificates],
  USE::environment_variables[.env+dotenv, secrets_managers],
  ROTATE::regularly[90_days_max],
  ACCESS::least_privilege[only_services_that_need_them]
]

EXAMPLE_ENV::
  # .env (gitignored)
  DATABASE_URL=postgresql://user:pass@localhost/db
  JWT_SECRET=random_256_bit_key
  API_KEY=sk_live_...

  # .env.example (committed)
  DATABASE_URL=postgresql://user:pass@localhost/dbname
  JWT_SECRET=your_secret_key_here
  API_KEY=your_api_key_here

---

CORS CONFIGURATION

CORS_SECURITY::[
  SPECIFIC_ORIGINS::whitelist_only["https://app.example.com"]≠wildcard["*"],
  CREDENTIALS::Access-Control-Allow-Credentials:_true→specific_origin_required,
  METHODS::limit_to_needed[GET,_POST,_PUT,_DELETE],
  HEADERS::whitelist_allowed[Content-Type,_Authorization]
]

---

HTTPS ENFORCEMENT

HTTPS_MANDATE::[
  PROD::ALWAYS_HTTPS[redirect_HTTP→HTTPS],
  HSTS::Strict-Transport-Security_header[max-age=31536000],
  CERTIFICATES::Let's_Encrypt_or_trusted_CA,
  MIXED_CONTENT::NO_HTTP_resources_on_HTTPS_pages
]

---

ERROR HANDLING

SECURE_ERRORS::[
  PROD::generic_messages["An error occurred"]≠detailed_stack_traces,
  LOG::full_details_server_side[for_debugging],
  CODES::use_standard_HTTP_status[400,_401,_403,_404,_500],
  NEVER::expose[database_schema, file_paths, internal_IPs, tech_stack_versions]
]

---

SECURITY HEADERS

REQUIRED_HEADERS::[
  Strict-Transport-Security::"max-age=31536000; includeSubDomains",
  X-Content-Type-Options::"nosniff",
  X-Frame-Options::"DENY",
  X-XSS-Protection::"1; mode=block",
  Content-Security-Policy::"default-src 'self'; script-src 'self' https://trusted.cdn.com",
  Referrer-Policy::"strict-origin-when-cross-origin"
]