API Security

API Security — OWASP API Security Top 10 (2023) for Next.js

Production-grade API security patterns for Next.js App Router. Covers every category in the OWASP API Security Top 10 (2023) with cross-references to the OWASP Web Top 10 (2021). Verified against the official OWASP specifications.

Architecture

Request → proxy.ts (auth gate) → Route Handler / Server Action
                                       ↓
                                  Input Validation (Zod)
                                       ↓
                                  Data Access Layer (auth + authz + DTO)
                                       ↓
                                  Database (parameterized queries)
                                       ↓
                                  Filtered Response (DTO, no raw records)

The Data Access Layer (DAL) is the central security architecture recommended by Next.js. All database access, authorization checks, and response filtering happen in one server-only module — never in components or actions directly.

Quick Reference

Decision Matrix: "Where Do I Add Security?"

The #1 Mistake: Server Actions Are Public Endpoints

Every exported 'use server' function is reachable via direct POST request. Page-level auth does NOT protect actions on that page.

// FAIL — no auth check, anyone can call this via POST
'use server'
export async function deleteAccount(userId: string) {
  await db.delete(users).where(eq(users.id, userId))
}

// PASS — validates auth AND ownership inside the action
'use server'
import { getCurrentUser } from '@/data/auth'

export async function deleteAccount() {
  const user = await getCurrentUser()
  if (!user) throw new Error('Unauthorized')
  await db.delete(users).where(eq(users.id, user.id))
}

Notice: the PASS version doesn't accept userId as a parameter — it derives it from the session. This prevents IDOR (Insecure Direct Object Reference).

Decision Matrix: "Is This Secure?"

OWASP API Security Top 10 (2023) — Full Mapping

OWASP Web Top 10 (2021) — Cross-Reference

Code Review Checklist

When reviewing API code in Next.js, verify:

• Every 'use server' function checks auth — no exceptions
• No user-supplied IDs used for ownership — derive from session
• All inputs validated with Zod before use
• Database queries use parameterized queries or ORM
• Responses return DTOs, not raw database records
• Error messages don't leak stack traces, SQL, or internal paths
• Security headers set in next.config.ts (CSP, HSTS, X-Frame-Options)
• Rate limiting on auth endpoints and expensive operations
• proxy.ts gates auth before page/action access
• Environment variables accessed only in server-only modules
• No fetch() to user-controlled URLs without allowlist
• Dependencies audited — no known vulnerabilities
• .env*.local in .gitignore