api-security-best-practices

Securing APIs against the OWASP API Security Top 10 requires implementing JWT authentication, input validation, and rate limiting. This skill provides comprehensive security patterns to mitigate common vulnerabilities like injection and broken authentication across REST, GraphQL, and WebSocket endpoints.

Preventing SQL injection requires parameterized queries and strict input sanitization. This skill uses Zod for schema validation and isomorphic-dompurify to sanitize inputs, ensuring malicious payloads are neutralized before reaching your backend database or GraphQL resolvers.

Configuring rate limiting for Express APIs involves applying middleware to restrict excessive requests. This skill utilizes express-rate-limit and rate-limit-redis with ioredis to establish automated protection strategies, preventing DDoS attacks and API abuse in production environments.

JWT authentication and role-based access control (RBAC) work by verifying user tokens and restricting endpoint permissions based on user roles. This skill implements these security patterns using jsonwebtoken and bcrypt to harden your API against unauthorized access.

Helmet.js can be used to manage HTTP security headers for your Node.js API. This skill offers ready-to-use configurations for security header management via Helmet.js, helping protect your application from cross-site scripting and other web vulnerabilities.

This skill provides comprehensive security patterns for WebSocket APIs in addition to REST and GraphQL. It covers the full lifecycle of API protection including authentication, input sanitization, and data encryption specifically tailored for WebSocket connections.