From e5827e7ddbbcfe70689c276a09745d86e48b76bb Mon Sep 17 00:00:00 2001 From: Julian Lechner Date: Thu, 24 Sep 2026 22:02:12 +0200 Subject: [PATCH] docs(security): strengthen API guidance --- shared/rules/security/references/api.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/shared/rules/security/references/api.md b/shared/rules/security/references/api.md index 9e775f1..6d3709c 100644 --- a/shared/rules/security/references/api.md +++ b/shared/rules/security/references/api.md @@ -1,7 +1,12 @@ # API security * Authenticate and authorize protected endpoints; validate every request payload and identifier. +* Enforce object-level authorization on every read and write, using the authenticated principal and resource ownership at the operation that accesses the data. +* Bind only explicitly permitted request fields. Do not allow mass assignment of ownership, role, state, or other privileged properties. * Bound request and response sizes, pagination, query results, and expensive operations. -* Apply rate limits where abuse is plausible and keep administrative endpoints separately protected. -* Return only authorized data and never expose stack traces, internal models, or implementation details in API errors. -* Prefer explicit DTOs and schemas over deserializing arbitrary types or executable objects. +* Apply rate limits and quotas to authentication, search, uploads, expensive operations, and other abuse-prone endpoints. Keep administrative routes separately protected. +* Define safe retry and idempotency behavior for state-changing requests. Protect against replay and duplicate side effects where relevant. +* Return only authorized fields. Do not expose stack traces, internal models, secrets, or implementation details in API responses or errors. +* Prefer explicit DTOs and schemas; reject unknown or ambiguous fields when accepting them could alter privileged state. +* Keep authorization, validation, serialization, and error responses consistent with the published schema and supported clients. +* Test malformed, oversized, unauthenticated, unauthorized, cross-user, cross-tenant, and duplicate requests within the approved scope.