API Security Best Practices

# CHAPTER 11

API Security Best Practices #

1. Introduction #

2. Learning Objectives #

• Explain why HTTPS is non-negotiable for REST APIs.

• Understand how CORS prevents malicious cross-origin attacks.

• Implement Rate Limiting to mitigate Brute Force and DDoS attacks.

• Differentiate between Input Validation and Input Sanitization.

• Identify the principles of Data Exposure prevention.

3. Beginner-Friendly Explanation #

• HTTPS: You build a concrete tunnel between the customer and the vault. No one outside the tunnel can see what the customer is carrying.

• CORS: You check the customer's ID to ensure they are coming from a trusted partner building, not a random location.

• Rate Limiting: If a customer tries 10,000 vault combinations in 5 seconds, you activate a trapdoor and lock them out for 15 minutes.

• Sanitization: Before the customer puts their box in the vault, you scan the box to ensure it doesn't contain a bomb (malicious SQL code).

4. Defense 1: Mandatory HTTPS (TLS) #

5. Defense 2: Rate Limiting #

Implementation (Express.js):

const rateLimit = require('express-rate-limit');

// Define the rule: Max 100 requests per 15 minutes per IP
const globalLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, 
    max: 100,
    message: "Too many requests from this IP, please try again after 15 minutes",
    headers: true, // Sends X-RateLimit headers to the client
});

// Apply globally to all API routes
app.use('/api/', globalLimiter);

*(When the limit is exceeded, the API automatically returns HTTP 429 Too Many Requests).*

6. Defense 3: CORS (Cross-Origin Resource Sharing) #

To fix this, you must configure CORS on your backend. You explicitly whitelist your trusted frontend domain.

Implementation (Express.js):

const cors = require('cors');

// Whitelist specific domains
const corsOptions = {
    origin: 'https://app.example.com',
    optionsSuccessStatus: 200
};

// Apply CORS middleware
app.use(cors(corsOptions));

*(Now, the API will add Access-Control-Allow-Origin: https://app.example.com to its HTTP Headers, and the browser will allow the request).*

7. Defense 4: Input Sanitization #

If a user submits a blog comment: <script>alert('Hacked!');</script>, and your API saves it directly to the database, you have created a severe Cross-Site Scripting (XSS) vulnerability. When other users load the comments, their browsers will execute that malicious Javascript.

Rule: Always strip dangerous HTML tags from incoming strings before saving them to the database. Libraries like DOMPurify or specific sanitization middleware will convert <script> into harmless encoded text (<script>).

8. Defense 5: Preventing Data Exposure #

// DANGEROUS!
app.get('/api/users/1', async (req, res) => {
    const user = await database.getUser(1);
    res.json(user); // Leaks password_hash, reset_tokens, internal IDs!
});

Rule: As discussed in Chapter 8, ALWAYS use an API Resource, Serializer, or Data Transfer Object (DTO) to explicitly map and filter exactly which database columns are allowed to be sent to the public.

9. Best Practices #

• Helmet.js: In Node.js, always install and use the helmet package. It automatically configures dozens of obscure HTTP security headers (like HSTS, X-Frame-Options, and Content Security Policies) that protect your API against common web vulnerabilities with just one line of code: app.use(helmet());

10. Common Mistakes #

• CORS Origin: * in Production: Setting your CORS origin to * (Wildcard) means "Allow any website on the internet to call this API." While this is fine for public, read-only APIs (like a weather API), it is disastrous for private APIs containing user data. Always explicitly define your trusted frontend URLs in your CORS configuration.

11. Exercises #

1. 1. Define the purpose of Rate Limiting. Which specific HTTP Status code is returned when a client triggers the rate limiter?

12. Coding Challenges #

• Challenge: You are architecting a highly secure login endpoint at POST /api/login. Should you apply the global rate limit (100 requests / 15 mins) to this specific route, or should you create a separate, much stricter rate limiter (e.g., 5 requests / 15 mins) just for the login route? Explain your reasoning in terms of Brute Force mitigation.

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain the difference between Input Validation and Input Sanitization. Provide a concrete example of a Cross-Site Scripting (XSS) vulnerability that occurs when sanitization is skipped on a text input field.

• Q: Walk me through the mechanics of CORS. Why do web browsers enforce the Same-Origin Policy, and how does the backend API explicitly override this policy to allow a trusted React frontend to consume its data?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #