TickYouOff
Sign in
Back
🛡️

REST API Security Hardening Checklist

Hard 16 items · 2 hours
testuser's avatar
testuser Published 1 month ago
Technical

This checklist helps engineers and dev teams harden REST APIs against common threats like token abuse, injection, and data leaks. It’s designed for backend developers, security engineers, and devops preparing APIs for production.

Progress
0 / 16
  1. Define API key rotation and revocation policy — Specify rotation interval, emergency revocation process, and audit logging.
  2. Rotate API keys and revoke compromised keys — Automate rotation and immediate revocation on compromise; notify clients.
  3. Implement JWT expiry and refresh token rotation — Use short-lived access tokens and rotate refresh tokens to detect reuse.
  4. Set short-lived access token lifetimes — Limit access tokens to minutes/hours; avoid long-lived access tokens.
  5. Rotate refresh tokens on use — Issue a new refresh token on each refresh and invalidate the previous one.
  6. Enforce HTTPS on all endpoints — Redirect HTTP to HTTPS, enable HSTS, and disable insecure protocols.
  7. Apply a strict CORS allowlist — Only allow required origins, specific methods, and limit credentials usage.
  8. Implement rate limiting per endpoint and client — Set different limits for auth, search, and heavy endpoints; include bursts and quotas.
  9. Validate all inputs and enforce JSON schema — Validate body, query, and path params; reject unexpected or extra fields.
  10. Prevent SQL injection with parameterized queries or ORM — Use prepared statements or ORM query builders; never concatenate SQL with user data.
  11. Return minimal data and avoid leaking sensitive fields — Remove internal IDs, secrets, tokens, and PII from API responses.
  12. Verify JWT signatures and validate claims — Check signature, issuer, audience, expiry, and token revocation lists.
  13. Enforce least-privilege access and scoped tokens — Use RBAC/ABAC and limit token scopes to required actions.
  14. Log, monitor, and alert on suspicious activity — Track auth failures, token reuse, spikes, and set actionable alerts.
  15. Run regular security scans and penetration tests — Schedule SAST/DAST scans and periodic pentests focused on auth and injection paths.
  16. Rotate signing keys (JWKS) with zero-downtime — Publish JWKS with kid, support key rollover, and keep old keys for validation window.
Sign in to save
📝 My Notes