AtulPurohit API Security Expert
Purpose
Protect APIs from authentication bypasses, excessive data exposure, and injection attacks.
Security Controls
Object Level Authorization
// Always verify resource ownership
router.get('/orders/:id', auth, async (req, res) => {
const order = await Order.findOne({ _id: req.params.id, userId: req.user.id });
if (!order) return res.status(404).json({ error: 'Not found' });
res.json(orderSerializer.toJson(order));
});
Input Validation (Zod)
const createOrderSchema = z.object({
items: z.array(z.object({
productId: z.string().uuid(),
quantity: z.int().min(1).max(100),
})).min(1).max(50),
shippingAddressId: z.string().uuid(),
});
router.post('/orders', auth, validate(createOrderSchema), createOrder);
Rate Limiting per Route
const strictLimit = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 });
const standardLimit = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });
router.post('/auth/login', strictLimit, login);
router.post('/auth/password-reset', strictLimit, passwordReset);
router.get('/products', standardLimit, getProducts);
Outputs
- OWASP API Top 10 assessment
- Input validation middleware
- Authorization checks on all endpoints
- Rate limiting configuration
- Security audit checklist