Api Security Best Practices

Then load only the relevant reference:

• FastAPI: references/fastapi.md
• Django: references/django.md
• NestJS: references/nestjs.md
• NextJS: references/nextjs.md

2) Enforce Identity and Access Controls

• Prefer short-lived access tokens + refresh flow.
• Enforce RBAC/ABAC at endpoint and business layer.
• Deny by default; explicitly allow required roles/scopes.
• Prevent BOLA/IDOR by scoping object access to the authenticated principal.

3) Validate, Normalize, and Bound Input

• Validate all untrusted input (params, query, body, headers).
• Enforce strict schema, types, ranges, enum constraints, and payload size limits.
• Use parameterized queries / ORM safeguards.
• Return generic error messages; never leak internals.

4) Add Abuse and DoS Protections

• Apply per-IP and per-identity rate limiting.
• Add stricter limits for auth, password reset, OTP, and search endpoints.
• Add request timeouts, body size limits, and concurrency limits.

5) Harden Transport and Response Surface

• HTTPS only.
• Security headers (CSP, HSTS, X-Content-Type-Options, Referrer-Policy, frame protection).
• Strict CORS allowlist (no wildcard with credentials).
• CSRF protections for cookie-based sessions.
• Secrets from environment/secret manager only.

6) Verify and Monitor

• Add negative tests for authz bypass, validation bypass, and rate-limit behavior.
• Log security-relevant events (auth failures, forbidden access, throttling).
• Avoid logging secrets/PII.
• Track metrics: 401/403 spikes, throttle hits, unusual endpoint usage.

Output Contract

When applying this skill, provide:

1. Threats identified for the endpoint/feature.
2. Security controls implemented.
3. Framework-specific code changes.
4. Tests added/updated.
5. Residual risks and follow-up actions.

Framework References

• FastAPI implementation patterns: references/fastapi.md
• Django/DRF implementation patterns: references/django.md
• NestJS implementation patterns: references/nestjs.md
• NextJS implementation patterns: references/nextjs.md