11 steps
APIs are the attack surface of modern applications. They expose your business logic, your data, and your infrastructure to the outside world. These steps address the most critical API security controls, from authentication and rate limiting to authorization edge cases that automated tools miss.
Protect every API endpoint with a robust mechanism: short-lived JWTs, OAuth 2.0, or API keys with rotation policies. Never leave endpoints unauthenticated unless they are explicitly public by design and reviewed.
Limit requests per IP, user, and token to prevent brute force, enumeration, and denial-of-service attacks. Return HTTP 429 with a Retry-After header. Implement separate limits for authentication endpoints.
Reject requests with unexpected fields, incorrect types, malformed values, or oversized payloads. Use a schema validation library (Zod, Joi, OpenAPI request validation) on every endpoint - not just registration forms.
Reject plaintext HTTP requests at your API gateway or load balancer. Set HSTS headers so clients remember to always use TLS. Enforce TLS 1.2+ with strong cipher suites and disable legacy protocol versions.
Whitelist only trusted, explicitly known origins. Avoid Access-Control-Allow-Origin: * for any authenticated API. Define Access-Control-Allow-Methods and Access-Control-Allow-Headers as narrowly as possible.
Do not expose stack traces, ORM model names, database errors, or internal paths in API error responses. Return structured, generic messages to clients and log the full diagnostic details server-side only.
Use explicit versioning (e.g., /v1/, /v2/) to allow safe deprecation of insecure or broken endpoints without forcing client breakage. Communicate sunset timelines and disable old versions on schedule.
Log every request with the authenticated identity, endpoint, HTTP status, and latency. Alert on spikes in 4xx/5xx errors, repeated authentication failures, and unusual access patterns indicative of enumeration or scraping.
Verify that the authenticated user is authorized to access the specific resource ID in every request - not just that they are logged in. BOLA is the most common API vulnerability and is rarely caught by automated scanners.
Require an HMAC signature header computed over the raw request body and a timestamp. Verify with a constant-time comparison, reject requests older than a few minutes, record processed event IDs to stop replays, and rotate signing secrets on a schedule.
Scope every API key or token to the minimum permissions and resources, set expirations, and store only a hash of API keys server-side. Provide self-service rotation with overlapping validity, revoke credentials immediately on suspicion of leak, and alert on use from unexpected networks.
