skills.rest
aicodepro
aicodeproOFFICIAL
Explore all skills by this author →
GitHub

api-security-hardening

Implements authentication, rate limiting, input validation, and security headers for REST APIs.

Updated Jun 22, 2026
Search Tags:#input validation#fastapi#rate limiting#security headers#nginx#express#api security
One-click install
npx skills add https://github.com/aicodepro/ai-agent-nexi --skill api-security-hardening-aicodepro
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security-hardening
Source: https://github.com/aicodepro/ai-agent-nexi/tree/main/agent/skills/api-security-hardening
Command: npx skills add https://github.com/aicodepro/ai-agent-nexi --skill api-security-hardening-aicodepro

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires helmet, express-rate-limit, express-mongo-sanitize, xss-clean, express-validator, fastapi, pydantic, slowapi, and includes references (resource) components.

What problem does it solve? Production REST APIs are exposed to injection attacks, brute-force attempts, cross-site scripting, and misconfigured CORS policies. This Skill provides concrete middleware configurations and validation patterns to harden Express, FastAPI, and Nginx-based APIs against common vulnerabilities. ## Core Features & Use Cases - Security Middleware Stack: Configures helmet, express-rate-limit, mongoSanitize, and xss-clean for Express, plus TrustedHost, CORS, and slowapi rate limiting for FastAPI. - Input Validation: Enforces email format, password strength rules, and field length limits using express-validator and Pydantic validators. - Infrastructure Hardening: Provides Nginx SSL/TLS configuration, security headers, request size limits, and HTTP Parameter Pollution prevention. - Use Case: Before deploying a new Express API to production, apply the rate limiting rules (100 requests per 15 minutes globally, 5 for auth endpoints), security headers, and the provided security checklist to pass a security audit. ## Quick Start Harden my Express REST API with rate limiting, input validation, and security headers using the api security skill.

Frequently Asked Questions about api-security-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add rate limiting to an Express API?▼

Use express-rate-limit middleware applied to route prefixes. Set windowMs to 15 minutes with max 100 requests for general API routes, and a stricter limit of 5 requests per window for authentication endpoints to mitigate brute-force attacks.

How to validate user input in FastAPI with Pydantic?▼

Define a Pydantic BaseModel with typed fields like EmailStr and add validator decorators for custom rules. Validators can enforce password length, uppercase letters, digits, special characters, and name length limits before the request reaches your handler.

What security headers should a REST API return?▼

Set Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff, Strict-Transport-Security with a one-year max-age, and X-XSS-Protection. In Express use helmet; in FastAPI add them via middleware; in Nginx use add_header directives.

Does helmet work with FastAPI or only Express?▼

Helmet is Express-specific middleware. For FastAPI, set the same security headers manually in an HTTP middleware function, and use TrustedHostMiddleware and CORSMiddleware for host validation and origin restrictions.

How do I prevent HTTP Parameter Pollution in FastAPI?▼

Declare query parameters explicitly with Query, set max_length constraints, and type list parameters as List[str] with a cap on array size. This ensures duplicated parameters are handled deterministically instead of being silently concatenated.

What are common API security mistakes to avoid?▼

Never trust unvalidated user input, return detailed stack traces in production, store secrets in code, use GET for state-changing operations, or disable security controls for convenience. These practices directly enable injection, information leakage, and CSRF attacks.

Related Skills

Explore More Software Engineering Skills→
igpastorigpastor

API Design Skill

Generate framework-specific API endpoints with routes, controllers, and OpenAPI documentation.

Community
Intermediate
patricio0312revpatricio0312rev
5

api-security-hardener

Apply rate limiting, input validation, authentication, and security headers to Node.js REST APIs.

Community
Advanced
darelabs-techdarelabs-tech

dare-security

Integrate security validation gates into the DARE development lifecycle.

Official
Advanced
sitharaj88sitharaj88
1

aws-waf

Generate AWS WAF configurations for CloudFront, ALB, API Gateway, AppSync, and Cognito.

Community
Advanced