The Problem

APIs are everywhere. Every modern application exposes them, and most organizations have more API endpoints than they realize. The attack surface is massive and growing.

The OWASP API Security Top 10 is a good starting point, but it reads more like a list of problems than a framework for solutions. Here is a practical API security framework you can actually implement.

Authentication Layer

Every API request must be authenticated. No exceptions.

  • OAuth 2.0 with PKCE for user-facing APIs. Do not use the implicit grant - it is deprecated for good reason.
  • API keys for server-to-server communication, but treat them as secrets. Rotate regularly. Never embed in client-side code.
  • JWT tokens with short expiration times (15 minutes max). Always validate the signature, issuer, audience, and expiration. Never trust the payload without verification.
# Bad: trusting JWT without verification
user_data = base64_decode(token.split('.')[1])

# Good: full verification
user_data = jwt.decode(token, public_key, algorithms=['RS256'],
                       audience='api.example.com',
                       issuer='auth.example.com')

Authorization Layer

Authentication tells you who the user is. Authorization tells you what they can do. These are separate concerns.

  • Implement object-level authorization on every endpoint. The #1 API vulnerability (BOLA/IDOR) exists because developers check if a user is logged in but not if they should access that specific resource.
  • Use attribute-based access control (ABAC) over simple role-based access control (RBAC) for fine-grained permissions.
  • Never rely on client-supplied IDs without server-side ownership validation.

Input Validation

Validate everything. Every parameter, header, and body field.

  • Define strict schemas (OpenAPI/Swagger) and validate against them.
  • Enforce type, length, range, and format constraints.
  • Sanitize inputs to prevent injection attacks (SQL, NoSQL, command injection).
  • Be especially careful with GraphQL - its flexible query language makes it easy to craft resource-exhausting queries.

Rate Limiting and Throttling

Without rate limiting, your API is a brute force target.

  • Implement per-user, per-IP, and per-endpoint rate limits.
  • Use sliding window algorithms over fixed windows to prevent burst attacks at window boundaries.
  • Return 429 status codes with Retry-After headers.
  • Apply stricter limits to authentication endpoints.

Monitoring and Logging

You cannot protect what you cannot see.

  • Log all authentication events, authorization failures, and input validation errors.
  • Monitor for anomalous patterns: unusual request volumes, geographic anomalies, sequential ID enumeration.
  • Set up alerts for brute force attempts, credential stuffing patterns, and data exfiltration indicators.
  • Ensure logs do not contain sensitive data (tokens, passwords, PII).

Transport Security

  • TLS 1.2 minimum, prefer TLS 1.3.
  • Implement certificate pinning for mobile applications.
  • Use HSTS headers to prevent downgrade attacks.
  • Disable compression on TLS connections to mitigate BREACH-style attacks.

Implementation Priority

If you can only do three things: fix BOLA/IDOR vulnerabilities first (they account for the majority of real-world API breaches), implement proper rate limiting second, and add comprehensive logging third. Everything else builds on this foundation.