skills.rest
MrJmpl3
MrJmpl3COMMUNITY
Explore all skills by this author →
𝕏@MrJmpl3GitHub

0002-api-security-best-practices

Harden API endpoints with authentication, validation, rate limiting, and error handling.

Updated Aug 23, 2026
Search Tags:#authorization#authentication#input validation#rate limiting#owasp#api security#secure error handling
One-click install
npx skills add https://github.com/MrJmpl3/codex_____data_____configuration --skill 0002-api-security-best-practices
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: 0002-api-security-best-practices
Source: https://github.com/MrJmpl3/codex_____data_____configuration/tree/main/skills/0002-api-security-best-practices
Command: npx skills add https://github.com/MrJmpl3/codex_____data_____configuration --skill 0002-api-security-best-practices

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps teams reduce real-world API security risks by providing practical guidance for authentication, authorization, validation, throttling, and safer handling of sensitive data.

Core Features & Use Cases

  • Authentication & Authorization Patterns: Implement JWT/OAuth/API key approaches and enforce RBAC to prevent unauthorized access.
  • Input Validation & Sanitization: Validate and sanitize requests to mitigate SQL injection, XSS, and command injection risks.
  • Rate Limiting & DDoS Mitigation: Apply per-user/IP throttles and graceful 429 responses to limit abuse and expensive operations.
  • Data Protection & Error Handling: Use HTTPS/TLS, sanitize error messages, and avoid leaking sensitive details.
  • Security Testing Guidance: Perform checks aligned with OWASP API Security Top 10 to verify defenses.

Use case example: Before shipping a new REST API endpoint, apply these patterns to ensure only properly authenticated and authorized clients can access resources, reject malicious input, and limit abusive traffic.

Quick Start

Ask an AI to provide an actionable security checklist and example implementation plan for protecting a new REST endpoint with strong authentication, validation, rate limiting, and safe error handling.

Frequently Asked Questions about 0002-api-security-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a REST API endpoint against common attacks before shipping?▼

Securing a REST API endpoint requires hardening authentication, enforcing RBAC authorization, validating inputs, applying rate limiting, and sanitizing error messages to mitigate injection, broken access control, and resource consumption attacks.

What is the best way to prevent broken access control and injection in APIs?▼

Preventing broken access control and injection in APIs requires strict RBAC enforcement, comprehensive input validation, and data sanitization to ensure only authenticated clients access permitted resources while rejecting malicious SQL, XSS, or command injection payloads.

How does rate limiting protect API endpoints from DDoS and abusive traffic?▼

Rate limiting protects API endpoints by applying per-user and per-IP throttles that restrict abusive traffic, returning graceful 429 responses to limit expensive operations and mitigate excessive resource consumption during DDoS attacks.

Does this API security guidance work for GraphQL and WebSocket patterns?▼

Yes, this API security guidance applies across REST, GraphQL, and WebSocket API patterns, providing mitigation coverage for common vulnerabilities like security misconfiguration and unauthorized access during endpoint design and security reviews.

Can I use this to align my API security review with the OWASP API Security Top 10?▼

Yes, you can use this guidance to perform security testing checks aligned with the OWASP API Security Top 10, verifying defense-in-depth controls against common API vulnerabilities during audit preparation and security reviews.

Why should I sanitize API error messages and what data should I avoid leaking?▼

Sanitizing API error messages prevents leaking sensitive details and security misconfigurations, using HTTPS/TLS for data protection and returning generic errors to clients while logging specific diagnostic details securely server-side.

Related Skills

Explore More Software Engineering Skills→
Serg28Serg28

api-designer

Create OpenAPI 3.1 YAML specifications with endpoints, schemas, and security.

Community
Intermediate
goodstoriesworldgoodstoriesworld

security-audit

Audit codebases for OWASP Top 10 vulnerabilities and generate structured reports.

Official
Advanced
AndreKuraitAndreKurait

creating-api-gateway-stage

Automate API Gateway stage configuration with CloudWatch logging, X-Ray tracing, and security.

Community
Advanced
Mentor-WizardMentor-Wizard
10

security-reviewer

Conduct security audits with SAST scans, vulnerability analysis, and penetration testing.

Official
Advanced