api-review

API Security Review Skill

Summary

Comprehensive security checklist for API endpoint development. Ensures proper authentication, authorization, input validation, output safety, and security logging are implemented before deployment.

When to Use

• Before merging any PR with API changes
• When creating new API endpoints
• When modifying authentication/authorization logic
• During security audits
• Code review of API routes

Quick Checklist

Pre-Deployment Security Audit

• Authentication: Route requires valid user identity
• Authorization: Ownership/permission checks implemented
• Input Validation: All inputs validated with schema (Zod/Joi/etc.)
• Output Safety: No sensitive data exposed in responses
• Logging: Security events logged appropriately
• Rate Limiting: Protection against abuse configured
• Error Handling: No system information leaked in errors

---

Authentication

Requirements

Every API endpoint must verify the user's identity before processing requests.

Next.js (App Router) with Clerk

import { auth } from '@clerk/nextjs';
import { NextResponse } from 'next/server';

export async function GET(request: Request) {
  // 1. Authenticate request
  const { userId } = await auth();

  if (!userId) {
    return NextResponse.json(
      { error: "Unauthorized" },
      { status: 401 }
    );
  }

  // Continue with authenticated request...
}

Express.js with JWT

import jwt from 'jsonwebtoken';
import { Request, Response, NextFunction } from 'express';

function authenticateToken(req: Request, res: Response, next: NextFunction) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) {
    return res.sendStatus(401);
  }

  jwt.verify(token, process.env.JWT_SECRET!, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
}

app.get('/api/protected', authenticateToken, (req, res) => {
  // Request is authenticated
});