API Security Checklist
The controls that keep an API from becoming a breach — auth, authorization, input handling, transport, and the OWASP API Top-10 traps.
Authentication
- Every non-public route
- Require a verified identity — no "internal" endpoint left open.
- Tokens
- Short-lived access tokens + refresh; verify signature, issuer, audience, expiry.
- Secrets
- Never hardcode. Use a vault/KMS/env; rotate; never log tokens or keys.
- Cookies
HttpOnly; Secure; SameSite. Protect state-changing routes from CSRF.
Authorization (the #1 API risk)
- Object-level (BOLA)
- Check the caller owns the object —
GET /orders/123must verify 123 is theirs. #1 OWASP API risk. - Function-level
- Enforce roles per action — don’t rely on the UI hiding admin buttons.
- Deny by default
- Whitelist what’s allowed; new endpoints start locked.
- Mass assignment
- Bind only allowed fields — never let a request set
roleorisAdmin.
Input & output
- Validate everything
- Schema-validate body, query, params. Reject unknown fields; bound sizes.
- Parameterized queries
- Always — the fix for SQL/NoSQL injection. Never string-concat inputs.
- Encode output
- Context-aware encoding to stop XSS; set
Content-Typeexplicitly. - Rate limit & quota
- Per-key/IP limits + payload size caps — blunt scraping, brute force, and DoS.
Transport & hygiene
- TLS only
- HTTPS everywhere + HSTS. Redirect HTTP → HTTPS.
- Minimal errors
- Generic error messages to clients; details to logs. No stack traces in responses.
- CORS narrowly
- Explicit allowed origins; never
*with credentials. - Security headers
- CSP,
X-Content-Type-Options: nosniff,X-Frame-Options. - Log & monitor
- Audit auth failures and anomalies; alert on spikes. Don’t log secrets/PII.