api-security

Files (2)

• README.md
• SKILL.md

SKILL.md (first lines)

# API Security

## Rules

- CORS: whitelist specific origins, never use `*` in production — list exact domains
- Rate limit per endpoint: auth endpoints (5/min), API reads (100/min), writes (20/min)
- Enforce request payload size limits: 1MB default body, 10MB for file uploads
- Validate `Content-Type` header matches actual payload — reject mismatches
- Disable `X-Powered-By` header — don't leak your framework
- API keys: support rotation (active + previous key valid during transition), hash stored keys
- Return `429 Too Many Requests` with `Retry-After` header when rate limited

```ts
// Express CORS — strict origin whitelist
import cors from "cors";
app.use(cors({
  origin: ["https://myapp.com", "https://app.myapp.com"],
  methods: ["GET", "POST", "PUT", "DELETE"],
  credentials: true,
}));
```

```ts
// Payload size limit
app.use(express.json({ limit: "1mb" }));

// Per-route rate limiting
import rateLimit from "express-rate-limit";
const loginLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 5,
  standardHeaders: true,
  message: { error: "Too many attempts, try again later" },
});
app.post("/api/login", loginLimiter, loginHandler);
```

## Avoid

- `Access-Control-Allow-Origin: *` with credentials — browsers block it, devs then disable CORS entirely
- No rate limiting on public endpoints — bots drain your resources and scrape your data
- Trusting API keys sent in query strings — they leak in logs, browser history, and referrer headers
- Exposing internal error details in API responses — return error codes, log details server-side

From YepAPI/skills, MIT.

More from YepAPI/skills