API Security in Practice: Authentication, Authorization & Common Attack Prevention

The Bottom Line: API Security Is Not “Just Add a Token”

Many teams invest only in “add a token” during early API development, then retrofit security after a data breach, API abuse, or malicious scraping incident. But security is not a patch — it is a structural concern that should be considered at the design stage.

This article covers three layers: authentication and authorization, common attack prevention, and a security configuration checklist.

---

1. Authentication and Authorization

1.1 Authentication Method Selection

Method	Pros	Cons	Best For
JWT	Stateless, cross-service, no storage needed	Cannot revoke, payload size	Microservices, external APIs
Session	Server-side logout, full control	Central storage needed	Monolith, admin systems
API Key	Simple, machine-to-machine	Coarse-grained	Third-party integrations

Recommended practice: Use JWT with short expiration (15-60 min) + Refresh Token for external APIs. Use Session + Redis for internal admin systems.

1.2 OAuth 2.0 Authorization Flows

OAuth 2.0 is the standard for authorizing third-party access to user data. Four flows for different scenarios:

Authorization Code + PKCE  → Third-party apps accessing user data (most common)
Client Credentials         → Service-to-service communication (no user authorization)
Resource Owner Password    → First-party app login (not recommended unless highly trusted)
Implicit                   → Deprecated, use PKCE instead

For most scenarios, Authorization Code + PKCE is sufficient.

1.3 Permission Model

Use RBAC (Role-Based Access Control) for API-level authorization:

{
  "userId": 1,
  "roles": ["admin", "editor"],
  "permissions": ["post:create", "post:edit", "user:delete"]
}

Middleware checks permissions on each protected endpoint:

function requirePermission(perm: string) {
  return (req, res, next) => {
    if (!req.user.permissions.includes(perm)) {
      return res.status(403).json({ error: 'forbidden' });
    }
    next();
  };
}

---

2. Common Attacks and Defense

2.1 SQL Injection

ORM frameworks have reduced prevalence, but SQL injection still exists in ORDER BY clauses, dynamic table names, and LIKE queries.

Defense: Always use parameterized queries, never concatenate SQL strings.

// ❌ Wrong
const sql = `SELECT * FROM users WHERE name = '${name}'`;

// ✅ Correct
const sql = 'SELECT * FROM users WHERE name = $1';

2.2 XSS (Cross-Site Scripting)

When an API returns user-generated content (comments, profiles), unescaped content can inject scripts.

Defense: HTML-escape user content before returning it, or ensure Content-Type: application/json prevents the browser from parsing the response as HTML.

2.3 CSRF (Cross-Site Request Forgery)

An attacker诱导s a logged-in user to visit a malicious link, exploiting the user’s session to perform unintended operations.

Defense: Use SameSite Cookie attribute (SameSite=Strict or SameSite=Lax), or require a CSRF Token on every write operation.

2.4 Rate Limiting

An API without rate limiting is an open invitation for abuse.

Layered rate limiting strategy:

Gateway: Global IP-based limit          → 100 req/min/IP
Application: Per-user granular limit    → 10 req/min/user (write operations)
Critical endpoints: Login/register      → 5 req/min/IP

Sliding window counter with Redis:

async function rateLimit(key: string, limit: number, window: number): Promise<boolean> {
  const current = await redis.incr(key);
  if (current === 1) await redis.expire(key, window);
  return current <= limit;
}

2.5 HTTPS

Every production API must enforce HTTPS. Reject HTTP at the code level:

if (req.headers['x-forwarded-proto'] !== 'https') {
  return res.redirect(301, `https://${req.headers.host}${req.url}`);
}

---

3. Security Configuration Checklist

Category	Item	Description
Transport	HTTPS enforcement	301 redirect + HSTS header
Authentication	Token expiration	JWT expiry ≤ 60 minutes
Authorization	Per-endpoint check	Verify permissions on every endpoint
Input	Parameterized queries	No SQL concatenation
Output	HTML escaping	Escape user content before returning
Request	Rate limiting	Layered (gateway + app + critical)
Request	CORS whitelist	Only trusted domains
Response	Security headers	X-Frame-Options, X-Content-Type-Options, Referrer-Policy

API security is not a one-time investment — every new endpoint and every dependency upgrade is an opportunity to review your security posture. A security checklist in Code Review and CI is far cheaper than fixing a breach post-incident.

Need backend API development or security auditing? Contact us — tell us your interface scope and scale, feasibility within 24 hours.

Related reading

• OpenAPI Best Practices — API specification and security configuration coordination
• REST vs GraphQL vs gRPC — upstream API protocol decision