implementing-api-schema-validation-security

Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.

Aller à l'installation

Dépôt: xalgord/xalgorix
Dernière activité de la source: 6 juin 2026 à 16:41
Langue détectée de SKILL.md: anglais
Étoiles: 813
Forks: 146

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/xalgord/xalgorix --skill implementing-api-schema-validation-security

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

Implementing API Schema Validation Security

Overview

API schema validation enforces that all data exchanged through APIs conforms to a predefined structure defined in OpenAPI Specification (OAS) or JSON Schema documents. This prevents injection attacks (SQLi, XSS, XXE), blocks mass assignment by rejecting unknown properties, prevents data leakage by validating response schemas, and ensures type safety across all API interactions. Schema validation operates at both the API gateway level (runtime enforcement) and during development (shift-left security).

When to Use

When deploying or configuring implementing api schema validation security capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Common Misconfigurations & Verification

additionalProperties missing or true: the single most common gap - without additionalProperties: false, mass-assignment fields pass validation; set it on every object schema.
Request-only validation: validating input but not responses lets excessive-data-exposure through; validate/serialize responses with explicit DTOs.
Loose constraints: strings without maxLength/pattern and fields without enum permit injection and DoS payloads.
readOnly not enforced server-side: clients can still write readOnly fields if the server only documents them rather than rejecting them.
Permissive/verbose errors: leaking schema detail in 400 responses aids attackers.
Spec drift: the deployed schema lagging the live API leaves new endpoints unvalidated.

How to verify it works: send a request with an extra/unknown field and confirm 400 (not silent acceptance); submit over-long and pattern-violating values and confirm rejection; attempt to set a readOnly field and confirm it is ignored; force a sensitive field into a response and confirm response validation strips it or fails safely; diff the enforced spec against the live route list.

Prerequisites

OpenAPI Specification v3.0 or v3.1 for all API endpoints
API gateway with schema validation support (Cloudflare API Shield, Kong, AWS API Gateway)
JSON Schema draft-07 or later understanding
Development environment with OpenAPI validation libraries
CI/CD pipeline for automated schema compliance testing

Core Implementation

OpenAPI Schema with Security Constraints

openapi: 3.1.0
info:
  title: Secure E-Commerce API
  version: 2.0.0
servers:
  - url: https://api.example.com/v2
    description: Production (HTTPS enforced)
security:
  - OAuth2:
      - read:products
      - write:orders

paths:
  /products:
    post:
      operationId: createProduct
      security:
        - OAuth2: [write:products]
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProductCreate'
      responses:
        '201':
          description: Product created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Product'
        '400':
           
        
           

  
    
       
      
          
           
           
          
             
             
             
      
        
          
            
              
                 


  
    
       
       [, , ]
      
        
           
           
           
             
        
           
           
          
        
           
           
           
           
           
        
           
           [, , , , ]
        
           
          
             
             
             
           
           
         

    
       
       [, , ]
      
        
           
           
           
        
           
        
           
        
           
        
           
          
             
        
           
           
           
         

    
       
       [, ]
      
        
           
           []

Server-Side Schema Validation (Python/FastAPI)

"""API Schema Validation Middleware for FastAPI

Enforces strict schema validation on all request and response payloads
to prevent injection, mass assignment, and data leakage attacks.
"""

from fastapi import FastAPI, Request, Response, HTTPException
from fastapi.middleware import Middleware
from pydantic import BaseModel, Field, field_validator, ConfigDict
from typing import List, Optional
import re
import json
from starlette.middleware.base import BaseHTTPMiddleware

app = FastAPI()


# Strict Pydantic models with security constraints
class ProductCreate(BaseModel):
    model_config = ConfigDict(extra='forbid')  # Reject unknown fields (mass assignment)

    name: str = Field(min_length=1, max_length=200, pattern=r'^[a-zA-Z0-9\s\-\.]+$')
    description: Optional[str] = Field(default=None, max_length=2000)
    price: float = Field(gt=0, le=999999.99)
    category: str = Field(pattern=r'^(electronics|clothing|food|furniture|other)$')
    tags: Optional[List[str]] = Field(default=None, max_length=10)

    @field_validator('name')
    @classmethod
    def ():
        
        dangerous_patterns = [, , , ]
        lower_v = v.lower()
         pattern  dangerous_patterns:
             pattern  lower_v:
                 ValueError()
         v



     ():
         v  :
             v
        
        sql_patterns = [
            ,
        ]
         pattern  sql_patterns:
             re.search(pattern, v, re.IGNORECASE):
                 ValueError()
         v



     ():
         v  :
             v
         (v) > :
             ValueError()
         tag  v:
              re.(, tag)  (tag) > :
                 ValueError()
         v


 ():
    
    model_config = ConfigDict(extra=)

    : 
    name: 
    price: 
    category: 
    tags: [] = []
    created_at: 


 ():
    

    SCHEMA_MAP = {
        : {
            : {: ProductResponse},
            : {: ProductResponse},
        }
    }

      ():
        response =  call_next(request)

        
        content_type = response.headers.get(, )
            content_type:
             response

        
        path = request.url.path
        method = request.method

        route_config = .SCHEMA_MAP.get(path, {}).get(method)
          route_config:
             response

        
        body = 
          chunk  response.body_iterator:
            body += chunk

        :
            data = json.loads(body)
            model = route_config[]
             (data, ):
                 item  data:
                    model.model_validate(item)
            :
                model.model_validate(data)
         Exception  e:
            
            ()
            
             Response(
                content=json.dumps({: }),
                status_code=,
                media_type=
            )

         Response(
            content=body,
            status_code=response.status_code,
            headers=(response.headers),
            media_type=response.media_type
        )


app.add_middleware(ResponseValidationMiddleware)



  ():

Cloudflare API Shield Schema Validation

# Upload OpenAPI schema to Cloudflare API Shield
curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/api_gateway/user_schemas" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: multipart/form-data" \
  -F "file=@openapi.yaml" \
  -F "kind=openapi_v3"

# Enable schema validation with blocking mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone_id}/api_gateway/settings/schema_validation" \
  -H "Authorization: Bearer ${CF_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "validation_default_mitigation_action": "block",
    "validation_override_mitigation_action": null
  }'

CI/CD Schema Compliance Testing

# GitHub Actions workflow for schema validation in CI
name: API Schema Security Check
on:
  pull_request:
    paths: ['api/**', 'openapi/**']

jobs:
  schema-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate OpenAPI Schema
        run: |
          npm install -g @stoplight/spectral-cli
          spectral lint openapi.yaml --ruleset .spectral-security.yaml

      - name: Check for Security Anti-Patterns
        run: |
          python3 scripts/schema_security_check.py openapi.yaml

      - name: Run Contract Tests
        run: |
          npm install -g dredd
          dredd openapi.yaml http://localhost:3000 --hookfiles=./test/hooks.js

Security Anti-Patterns to Detect

Anti-Pattern	Risk	Fix
`additionalProperties: true` or missing	Mass assignment	Set `additionalProperties: false`
No `maxLength` on strings	Buffer overflow, DoS	Add appropriate `maxLength` constraints
No `pattern` on string fields	Injection attacks	Add regex patterns to restrict input
No `enum` for fixed-value fields	Unexpected input processing	Use `enum` for fields with known values
`format: password` without TLS	Credential exposure	Enforce HTTPS-only server URLs
Missing error response schemas	Information leakage	Define all 4xx/5xx response schemas
`readOnly` fields in request body	Data manipulation	Enforce `readOnly` server-side

References

OpenAPI Specification v3.1: https://spec.openapis.org/oas/v3.1.0
Cloudflare API Shield Schema Validation: https://developers.cloudflare.com/api-shield/security/schema-validation/
Redocly API Security by Design: https://redocly.com/learn/security
Impart Security API Validation: https://www.impart.ai/blog/detect-and-fix-api-vulnerabilities-using-validation-secure-principles-and-real-time-response
OWASP API Security Top 10 2023: https://owasp.org/API-Security/editions/2023/en/0x00-header/

name	implementing-api-schema-validation-security
description	Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.
domain	cybersecurity
subdomain	api-security
tags	["api-security","schema-validation","openapi","json-schema","input-validation","data-leakage-prevention","mass-assignment","api-gateway"]
version	1.0
author	mahipal
license	Apache-2.0