api-security-best-practices

API Security Best Practices

Review the request boundary from caller identity through authorization, validated input, storage and observable response. Preserve the application's actual identity provider and data model rather than introducing a second authentication system.

When to Use

Use when adding a protected endpoint, reviewing object access, replacing permissive request parsing, or investigating an API abuse path. For a concrete defect, start with the failing route and its callers; do not deploy unrelated security infrastructure.

Inputs and prerequisites

Record the routes, caller/tenant model, identity provider, token contract, runtime and locked dependency versions, database schema, proxy topology and authorized test scope. Use synthetic identities in a test environment. Existing task authorization carries forward; production scans, account writes and message sends need their own authority. The Node examples below are integration sketches for Express, jsonwebtoken and Zod; application/database adapters are deliberately named rather than presented as a full runnable service. Confirm APIs against the installed versions before integrating.

1. Authenticate the exact token contract

Prefer the established provider/session middleware. When the service owns an HMAC JWT contract, require a strong server-owned key, a fixed algorithm, exact issuer and audience, and required runtime claims. Do not infer permissions from a decoded token before signature verification. Never accept a caller-selected verification algorithm.

const jwt = require('jsonwebtoken');

// Illustrative first-party access-token contract; not a third-party OAuth adapter.
const ACCESS_POLICY = {
  algorithms: ['HS256'], issuer: 'example-auth', audience: 'example-api'
};
function verifyAccessToken(token, signingKey) {
  const claims = jwt.verify(token, signingKey, ACCESS_POLICY);
  if (!claims || typeof claims !== 'object' ||
      typeof claims.sub !== 'string' || !claims.sub ||
      typeof claims.tenantId !== 'string' || !claims.tenantId ||
      !Number.isSafeInteger(claims.exp) || !Number.isSafeInteger(claims.iat) ||
      claims.exp <= claims.iat) {
    throw new Error('Invalid access claims');
  }
  return { subject: claims.sub, tenantId: claims.tenantId };
}
function readBearer(header) {
  if (typeof header !== 'string' || header.length > 8192) return null;
  const match = /^Bearer ([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/i.exec(header);
  return match ? match[1] : null;
}