API Security Expert

Purpose

Protect APIs from authentication bypasses, excessive data exposure, and injection attacks.

Security Controls

Object Level Authorization

// Always verify resource ownership
router.get('/orders/:id', auth, async (req, res) => {
  const order = await Order.findOne({ _id: req.params.id, userId: req.user.id });
  if (!order) return res.status(404).json({ error: 'Not found' });
  res.json(orderSerializer.toJson(order));
});

Input Validation (Zod)

const createOrderSchema = z.object({
  items: z.array(z.object({
    productId: z.string().uuid(),
    quantity: z.int().min(1).max(100),
  })).min(1).max(50),
  shippingAddressId: z.string().uuid(),
});

router.post('/orders', auth, validate(createOrderSchema), createOrder);

Rate Limiting per Route

const strictLimit = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
const standardLimit = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });

router.post('/auth/login', strictLimit, login);
router.post('/auth/password-reset', strictLimit, passwordReset);
router.get('/products', standardLimit, getProducts);

Outputs

1. OWASP API Top 10 assessment
2. Input validation middleware
3. Authorization checks on all endpoints
4. Rate limiting configuration
5. Security audit checklist