api-security-hardening

What problem does it solve?

Protect RESTful APIs from common web threats by providing practical, opinionated guidance and implementations for authentication, rate limiting, CORS, input validation, security headers, and monitoring so teams can reduce attack surface and prevent abuse.

Core Features & Use Cases

• Authentication & Authorization: JWT and API key examples with role-based access controls for protected endpoints.
• Traffic Controls: Rate limiting and gateway-level limits to mitigate abuse and DDoS vectors.
• Input & Payload Safety: Input validation, NoSQL injection sanitization, XSS prevention, and parameter pollution protection.
• Deployment Guidance: API gateway/nginx hardening and environment-specific recommendations for Node.js/Express and Python/FastAPI.
• Use Case: Harden a public API for production by adding security middleware, strict CORS policies, request size limits, and centralized security logging.

Quick Start

Use the api-security-hardening skill to add authentication, rate limiting, input validation, security headers, and logging to your API.