REST API Security Hardening Checklist

16 items · Technical · Hard difficulty · 2 hours

Harden your REST API with tokens, rate limits, CORS, and input-validation best practices.

• Define API key rotation and revocation policy

  Specify rotation interval, emergency revocation process, and audit logging.

• Rotate API keys and revoke compromised keys

  Automate rotation and immediate revocation on compromise; notify clients.

• Implement JWT expiry and refresh token rotation

  Use short-lived access tokens and rotate refresh tokens to detect reuse.

• Set short-lived access token lifetimes

  Limit access tokens to minutes/hours; avoid long-lived access tokens.

• Rotate refresh tokens on use

  Issue a new refresh token on each refresh and invalidate the previous one.

• Enforce HTTPS on all endpoints

  Redirect HTTP to HTTPS, enable HSTS, and disable insecure protocols.

• Apply a strict CORS allowlist

  Only allow required origins, specific methods, and limit credentials usage.

• Implement rate limiting per endpoint and client

  Set different limits for auth, search, and heavy endpoints; include bursts and quotas.

• Validate all inputs and enforce JSON schema

  Validate body, query, and path params; reject unexpected or extra fields.

• Prevent SQL injection with parameterized queries or ORM

  Use prepared statements or ORM query builders; never concatenate SQL with user data.

• Return minimal data and avoid leaking sensitive fields

  Remove internal IDs, secrets, tokens, and PII from API responses.

• Verify JWT signatures and validate claims

  Check signature, issuer, audience, expiry, and token revocation lists.

• Enforce least-privilege access and scoped tokens

  Use RBAC/ABAC and limit token scopes to required actions.

• Log, monitor, and alert on suspicious activity

  Track auth failures, token reuse, spikes, and set actionable alerts.

• Run regular security scans and penetration tests

  Schedule SAST/DAST scans and periodic pentests focused on auth and injection paths.

• Rotate signing keys (JWKS) with zero-downtime

  Publish JWKS with kid, support key rollover, and keep old keys for validation window.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.