API Security Best Practices Reference
Comprehensive 参考为 API 安全: 认证, 授权, 输入 validation, 和监控.
Authentication and Authorization
APIs should use strong authentication: OAuth 2.0 for delegated access, API keys for simple auth, mTLS for high security. JWTs must validate signature, expiry, issuer, and audience. Authorization checks must happen per-object (BOLA prevention) and per-property. Scope-based access control limits what actions a token allows. Least privilege: tokens should have minimal necessary scopes. Token rotation and revocation are essential for compromised credentials.
- OAuth 2.0
- Delegated access
- per-object
- BOLA prevention
- scopes
- Minimal privileges
authorization codecheck every objectleast privilegeInput and Output Security
Validate all input against strict schemas (JSON Schema, OpenAPI). Reject unknown fields to prevent mass assignment. Limit payload size and nesting depth to prevent DoS. Sanitize and encode output to prevent injection. Use parameterized queries for database access. Rate limit per-client to prevent abuse. Log all access for audit and anomaly detection. Version APIs to allow breaking changes safely. Deprecate insecure versions with clear timelines.
- schema
- Strict validation
- size limit
- Prevent DoS
- logging
- Audit trail
reject unknownpayload + depthanomaly detection