Owasp Security

2. JWT (JSON Web Token) Security

When issuing or validating JWTs:

• Claims Verification: Always validate all standard claims:
  • exp (Expiration Time): Ensure tokens are short-lived.
  • iss (Issuer): Verify the token came from your trusted authorization server.
  • aud (Audience): Ensure the token is intended for this specific API.
  • jti (JWT ID): Issue unique IDs to track individual tokens and facilitate blocklisting.
• Signature Algorithm: Use strong asymmetric algorithms like RS256 or ES256. Do not allow none algorithm.

3. Data Validation & Injection Prevention

• Input Validation: Strictly validate all untrusted input against an OpenAPI schema (or similar strict types) before processing.
• SQL Injection: Always use ORMs (like ent) or parameterized queries. Never concatenate strings into raw SQL queries.

4. Secure API Design

• Least Privilege: Protect administrative or sensitive routes with appropriate Role-Based Access Control (RBAC). Use multi-level scopes if applicable.
• Error Handling: Do not expose internal system errors, stack traces, or database implementation details in API responses. Over-sharing aids attackers in fingerprinting the system.

5. Security Checklist for New Endpoints

Before finalizing any new feature, verify:

• Is authentication required and enforced via middleware?
• Are permissions verified at the business logic layer (not just route layer)?
• Are request payloads rigidly checked against their type schemas?
• Does the endpoint leak sensitive PII or system architectures in error scenarios?

Examples

Good: Generic Login Response (Anti-Enumeration)

func Login(email, password string) error {
    user, err := repo.FindByEmail(email)
    if err != nil {
        domain.CompareDummyPassword(password) // Thwart timing attacks
        return errors.New("invalid credentials")
    }
    if !user.CheckPassword(password) {
        return errors.New("invalid credentials")
    }
    return nil
}

Bad: Leaky Error Response

func Login(email, password string) error {
    user, err := repo.FindByEmail(email)
    if err != nil {
        return errors.New("user not found") // EXPOSES VALIDITY OF EMAIL
    }
    // ...
}