skills.rest
dolsoon
dolsoonCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

moai-security-api

Protects against unauthorized access and monitors for policy violations in real time.

Updated Dec 2, 2025
Search Tags:#OWASP#rate limiting#GraphQL#API security#OAuth#JWT#gRPC#enterprise security
One-click install
npx skills add https://github.com/dolsoon/my-awesome-project --skill moai-security-api-dolsoon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: moai-security-api
Source: https://github.com/dolsoon/my-awesome-project/tree/main/.claude/skills/moai-security-api
Command: npx skills add https://github.com/dolsoon/my-awesome-project --skill moai-security-api-dolsoon

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsonwebtoken, passport, passport-oauth2, redis, helmet, express-rate-limit, express, and includes examples (resource) and references (resource) components.

What problem does it solve?

This Skill provides comprehensive solutions for securing REST, GraphQL, and gRPC APIs against modern threats, addressing complex challenges like broken authentication, excessive data exposure, and rate limit bypasses. It helps you implement robust security patterns, saving time on vulnerability research and ensuring compliance.

Core Features & Use Cases

  • OAuth 2.1 + JWT Framework: Implements secure authentication and authorization using industry-standard protocols with PKCE and RS256 verification.
  • Multi-Tenant Security Patterns: Guides on isolating data and preventing Broken Object Level Authorization (BOLA) in multi-tenant environments.
  • Rate Limiting & Webhook Security: Protects your APIs from abuse with token bucket algorithms and secures webhook deliveries using HMAC-SHA256 signatures.
  • Use Case: Implement secure authentication and authorization for your Express.js REST API, including distributed rate limiting and tenant isolation, to protect sensitive user data and prevent abuse, ensuring your API is production-ready.

Quick Start

Provide a code example for implementing JWT authentication and scope-based authorization in an Express.js API.

Frequently Asked Questions about moai-security-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement OAuth 2.1 and JWT authentication for my REST API?▼

OAuth 2.1 and JWT authentication secure API access by validating user identity and permissions. Implement PKCE-protected OAuth flows with RS256 JWT verification in Express.js to authenticate requests, validate tokens, and enforce scope-based authorization before processing sensitive operations.

How can I prevent rate limit bypasses and API abuse?▼

Rate limiting protects APIs from abuse by restricting request frequency per user or IP. Implement distributed rate limiting using token bucket algorithms across your Express.js API and gateway layers to stop brute-force attacks and ensure fair resource allocation in production workloads.

What's the best way to secure GraphQL and gRPC endpoints against unauthorized access?▼

GraphQL and gRPC endpoints require the same authentication rigor as REST APIs. Apply OAuth 2.1, JWT validation, and RBAC/ABAC scope enforcement consistently across all endpoint types to block broken authentication and excessive data exposure vulnerabilities.

How do I isolate tenant data and prevent broken object-level authorization in multi-tenant APIs?▼

Multi-tenant security isolates each customer's data to prevent cross-tenant leakage. Enforce per-tenant data isolation, implement role and attribute-based access control (RBAC/ABAC), and validate authorization on every object-level request to block BOLA attacks in microservices.

Can I use Express.js with API keys and token revocation for enterprise deployments?▼

Express.js supports API key validation and token revocation through middleware. Combine API key management with Redis-backed token revocation and distributed rate limiting to meet enterprise security requirements across microservices and production workloads.

Does this approach address OWASP API Top 10 vulnerabilities?▼

OWASP API Top 10 mitigations address broken authentication, excessive data exposure, and injection attacks. This skill implements OAuth 2.1, JWT validation, rate limiting, and webhook HMAC-SHA256 signatures to satisfy functional and compliance requirements for production APIs.

Related Skills

Explore More Software Engineering Skills→
dhruvinrsonidhruvinrsoni

auth-implementation

Implement JWT, OAuth2, RBAC, and API key authentication with security hardening.

Community
Advanced
thejefflarsonthejefflarson
20

model-theft

Enforce authentication, rate limits, and response sanitization on inference endpoints.

Community
Intermediate
gil00pitagil00pita

passport

Configure Passport.js local, OAuth, and JWT strategies for Express/Node.js APIs.

Community
Advanced
cenjiecenjie

api-security-hardening

Secure REST APIs with authentication, rate limiting, CORS, and input validation.

Community
Advanced