API security

Overview

API security protects your endpoints from unauthorized access, data leaks, abuse, and attacks. Because APIs expose business logic and data directly, the most common failures are not exotic hacks but missing checks: returning another user's data, trusting client input, exposing too many fields, or allowing unlimited requests.

A secure API layers several defenses: HTTPS everywhere, strong authentication, per-object authorization, strict input validation, rate limiting and quotas, safe error handling, secrets management, and monitoring. The OWASP API Security Top 10 is the standard checklist.

When to use it

• Every API, internal or external.
• Security reviews and threat modeling.
• Designing public APIs, partner integrations, and mobile backends.
• Interview follow-ups: 'how would you secure this?'.

Where it shows up in interviews

Where it is used in real software

Key terms

BOLA / IDOR

Accessing objects that belong to others by changing IDs.

Mass assignment

Clients setting fields they should not (isAdmin: true) because the server binds the whole body.

Input validation

Reject requests that do not match the expected schema, types, and limits.

Injection

Untrusted input interpreted as code: SQL, NoSQL, command, template injection.

SSRF

Server-side request forgery: tricking the server into calling internal URLs.

Defense layers for every request

1. 1
   Transport

   HTTPS only, HSTS, modern TLS.

2. 2
   Authenticate

   Validate tokens or keys; reject missing or expired credentials.

3. 3
   Authorize per object

   Confirm this caller may perform this action on this resource.

4. 4
   Validate input

   Schema validation with allow-listed fields, types, sizes, and formats; parameterized queries.

5. 5
   Limit resources

   Rate limits, payload size limits, pagination caps, and timeouts.

6. 6
   Minimize output

   Return only needed fields; generic error messages; no stack traces.

7. 7
   Observe

   Audit logs, anomaly detection, and alerts on unusual patterns.

Common API vulnerabilities and fixes

Based on the OWASP API Security Top 10

Most issues are missing checks in application code, which gateways and WAFs cannot fully fix. Authorization and validation must live in the service.

Implementation

1import { z } from "zod";2 3// Allow-list exactly which fields a client may update4const UpdateProfile = z.object({5  displayName: z.string().trim().min(1).max(50),6  bio: z.string().max(280).optional(),7}).strict(); // unknown fields (like role) are rejected8 9app.patch("/v1/users/me", async (req, res) => {10  const parsed = UpdateProfile.safeParse(req.body);11  if (!parsed.success) return res.status(400).json({ error: { code: "invalid_request" } });12  const user = await users.update(req.user.id, parsed.data);   // only the caller's own record13  res.json({ id: user.id, displayName: user.displayName, bio: user.bio }); // explicit output14});15 16// Parameterized query: input can never change the SQL structure17const orders = await db.query(18  "SELECT id, total FROM orders WHERE user_id = $1 AND status = $2 LIMIT 50",19  [req.user.id, req.query.status],20);

Complexity and performance

Trade-offs

Variants and related techniques

Common mistakes

• Assuming internal APIs are safe.

  Fix: Apply authentication and authorization inside the network too (zero trust).

• Hardcoded secrets in code or images.

  Fix: Use a secrets manager and rotate credentials.

• Logging tokens and personal data.

  Fix: Redact sensitive fields in logs.

Interview questions

Practice problems