13 lines
1.3 KiB
Markdown
13 lines
1.3 KiB
Markdown
# API security
|
|
|
|
* Authenticate and authorize protected endpoints; validate every request payload and identifier.
|
|
* Enforce object-level authorization on every read and write, using the authenticated principal and resource ownership at the operation that accesses the data.
|
|
* Bind only explicitly permitted request fields. Do not allow mass assignment of ownership, role, state, or other privileged properties.
|
|
* Bound request and response sizes, pagination, query results, and expensive operations.
|
|
* Apply rate limits and quotas to authentication, search, uploads, expensive operations, and other abuse-prone endpoints. Keep administrative routes separately protected.
|
|
* Define safe retry and idempotency behavior for state-changing requests. Protect against replay and duplicate side effects where relevant.
|
|
* Return only authorized fields. Do not expose stack traces, internal models, secrets, or implementation details in API responses or errors.
|
|
* Prefer explicit DTOs and schemas; reject unknown or ambiguous fields when accepting them could alter privileged state.
|
|
* Keep authorization, validation, serialization, and error responses consistent with the published schema and supported clients.
|
|
* Test malformed, oversized, unauthenticated, unauthorized, cross-user, cross-tenant, and duplicate requests within the user's requested scope.
|