API Security Checklist

API Security Checklist — Web App API Security Checklist

An OWASP-based security checklist, authentication patterns, and defense code guide that the backend-dev agent uses during API development.

Target Agent

backend-dev — Applies this skill's security checklist directly to API implementation.

OWASP API Security Top 10 Check

Authentication Patterns

JWT-Based Authentication

Password Policy

• Minimum 8 characters, recommend uppercase + lowercase + numbers + special chars (show strength rather than enforce)
• bcrypt (cost factor 12+) or Argon2id
• Password history (prevent reuse of last 5)
• Temporary lock after 5 failed login attempts (15 min) or CAPTCHA

Authorization Patterns

RBAC (Role-Based)

Role definitions: admin, manager, user, viewer
Permission mapping:
  admin    → *.* (full access)
  manager  → resource.create, resource.read, resource.update
  user     → resource.create (own), resource.read (own)
  viewer   → resource.read (public)

Middleware Chain

Request → [Rate Limit] → [Auth: JWT verification] → [Authorization: role check] → [Input Validation] → Handler

Input Validation Checklist

HTTP Security Headers

CORS Configuration Guide

Required settings:

• methods: Allow only necessary methods
• allowedHeaders: Only necessary headers
• credentials: Set to true only when cookies are needed
• maxAge: Preflight caching (86400 seconds)

Rate Limiting Strategy

Response Headers

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1609459200
Retry-After: 60 (on 429 response)

Error Response Security

Production Error Response Rules

• Never expose internal implementation details (stack traces, SQL queries)
• Use consistent error format
• Prevent enumeration attacks: On login failure, show "Email or password is incorrect" (don't reveal which one is wrong)

Error Response Format

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Input is invalid",
    "details": [
      {"field": "email", "message": "Please enter a valid email"}
    ]
  }
}

Sensitive Data Handling