菜单
Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/autohandai/community-skills --skill implementing-api-schema-validation-security命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | implementing-api-schema-validation-security |
| description | Implement API schema validation using OpenAPI specifications and JSON Schema to enforce input/output contracts and prevent injection, data exposure, and mass assignment attacks. |
| domain | cybersecurity |
| subdomain | api-security |
| tags | ["api-security","schema-validation","openapi","json-schema","input-validation","data-leakage-prevention","mass-assignment","api-gateway"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
API schema validation enforces that all data exchanged through APIs conforms to a predefined structure defined in OpenAPI Specification (OAS) or JSON Schema documents. This prevents injection attacks (SQLi, XSS, XXE), blocks mass assignment by rejecting unknown properties, prevents data leakage by validating response schemas, and ensures type safety across all API interactions. Schema validation operates at both the API gateway level (runtime enforcement) and during development (shift-left security).
openapi: 3.1.0
info:
title: Secure E-Commerce API
version: 2.0.0
servers:
- url: https://api.example.com/v2
description: Production (HTTPS enforced)
security:
- OAuth2:
- read:products
- write:orders
paths:
/products:
post:
operationId: createProduct
security:
- OAuth2: [write:products]
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ProductCreate'
responses:
'201':
description: Product created
content:
application/json:
schema:
$ref: '#/components/schemas/Product'
'400':
[, , ]
[, , , , ]
[, , ]
[, ]
[]
"""API Schema Validation Middleware for FastAPI
Enforces strict schema validation on all request and response payloads
to prevent injection, mass assignment, and data leakage attacks.
"""
from fastapi import FastAPI, Request, Response, HTTPException
from fastapi.middleware import Middleware
from pydantic import BaseModel, Field, field_validator, ConfigDict
from typing import List, Optional
import re
import json
from starlette.middleware.base import BaseHTTPMiddleware
app = FastAPI()
# Strict Pydantic models with security constraints
class ProductCreate(BaseModel):
model_config = ConfigDict(extra='forbid') # Reject unknown fields (mass assignment)
name: str = Field(min_length=1, max_length=200, pattern=r'^[a-zA-Z0-9\s\-\.]+$')
description: Optional[str] = Field(default=None, max_length=2000)
price: float = Field(gt=0, le=999999.99)
category: str = Field(pattern=r'^(electronics|clothing|food|furniture|other)$')
tags: Optional[List[str]] = Field(default=None, max_length=10)
@field_validator('name')
@classmethod
def ():
dangerous_patterns = [, , , ]
lower_v = v.lower()
pattern dangerous_patterns:
pattern lower_v:
ValueError()
v
():
v :
v
sql_patterns = [
,
]
pattern sql_patterns:
re.search(pattern, v, re.IGNORECASE):
ValueError()
v
():
v :
v
(v) > :
ValueError()
tag v:
re.(, tag) (tag) > :
ValueError()
v
():
model_config = ConfigDict(extra=)
:
name:
price:
category:
tags: [] = []
created_at:
():
SCHEMA_MAP = {
: {
: {: ProductResponse},
: {: ProductResponse},
}
}
():
response = call_next(request)
content_type = response.headers.get(, )
content_type:
response
path = request.url.path
method = request.method
route_config = .SCHEMA_MAP.get(path, {}).get(method)
route_config:
response
body =
chunk response.body_iterator:
body += chunk
:
data = json.loads(body)
model = route_config[]
(data, ):
item data:
model.model_validate(item)
:
model.model_validate(data)
Exception e:
()
Response(
content=json.dumps({: }),
status_code=,
media_type=
)
Response(
content=body,
status_code=response.status_code,
headers=(response.headers),
media_type=response.media_type
)
app.add_middleware(ResponseValidationMiddleware)
():
# Upload OpenAPI schema to Cloudflare API Shield
curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/api_gateway/user_schemas" \
-H "Authorization: Bearer ${CF_API_TOKEN}" \
-H "Content-Type: multipart/form-data" \
-F "file=@openapi.yaml" \
-F "kind=openapi_v3"
# Enable schema validation with blocking mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone_id}/api_gateway/settings/schema_validation" \
-H "Authorization: Bearer ${CF_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"validation_default_mitigation_action": "block",
"validation_override_mitigation_action": null
}'
# GitHub Actions workflow for schema validation in CI
name: API Schema Security Check
on:
pull_request:
paths: ['api/**', 'openapi/**']
jobs:
schema-security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Validate OpenAPI Schema
run: |
npm install -g @stoplight/spectral-cli
spectral lint openapi.yaml --ruleset .spectral-security.yaml
- name: Check for Security Anti-Patterns
run: |
python3 scripts/schema_security_check.py openapi.yaml
- name: Run Contract Tests
run: |
npm install -g dredd
dredd openapi.yaml http://localhost:3000 --hookfiles=./test/hooks.js
| Anti-Pattern | Risk | Fix |
|---|---|---|
additionalProperties: true or missing | Mass assignment | Set additionalProperties: false |
No maxLength on strings | Buffer overflow, DoS | Add appropriate maxLength constraints |
No pattern on string fields | Injection attacks | Add regex patterns to restrict input |
No enum for fixed-value fields | Unexpected input processing | Use enum for fields with known values |
format: password without TLS | Credential exposure | Enforce HTTPS-only server URLs |
| Missing error response schemas | Information leakage | Define all 4xx/5xx response schemas |
readOnly fields in request body | Data manipulation | Enforce readOnly server-side |