Security

Security is not a feature you bolt on; it is a set of concerns that touch every endpoint. This module covers the ones every API must address.

The surface

flowchart TD
  API --> T[Transport: HTTPS everywhere]
  API --> AuthN[Authentication: who are you?]
  API --> AuthZ[Authorization: what may you do?]
  API --> In[Input: validate everything]
  API --> Ab[Abuse: rate limiting & quotas]

Five concerns that span the whole API

• Transport — serve only over HTTPS; never accept credentials over plain HTTP.
• Authentication — establish who the caller is (API key, token).
• Authorization — decide what that caller may do.
• Input — treat every byte from the client as untrusted; validate it.
• Abuse — protect the API from being overwhelmed or scraped.

What this module covers

• Authn vs authz — the difference, and 401 vs 403.
• Tokens, JWT & OAuth — bearer tokens and delegated access.
• CORS — how browsers gate cross-origin calls.
• Rate limiting & validation — throttling and trusting nothing.

🌐 Never put secrets in the URL

API keys, tokens, and passwords must never appear in the path or query string — URLs are logged by servers, proxies, and browser history, and leak through Referer headers. Credentials belong in the Authorization header (or a secure cookie), and everything travels over HTTPS.

Why must credentials never go in the URL?

URLs are too short URLs are logged and leak via history and Referer headers The query string cannot hold text It breaks caching

How should client input be treated?

As trusted once authenticated As untrusted and validated on every request Only validated in development Validated by the client only

Submit

Mark as complete