API Security Checklist for Production Systems

Introduction#

Public and internal APIs are high-value attack surfaces. A practical checklist ensures that every release includes the required controls for identity, transport, input validation, and abuse prevention.

Identity and Access Controls#

Enforce OAuth2 or mutual TLS for all production APIs.
Validate issuer, audience, and signature for every token.
Use short-lived tokens and enforce refresh token rotation.
Restrict scopes to the minimum required actions.

Transport and Session Protections#

Require TLS 1.2+ and disable weak cipher suites.
Use HSTS headers for browser-exposed endpoints.
Bind session tokens to device or client context when possible.
Reject requests with missing or duplicate X-Request-Id values.

Input Validation and Data Safety#

Validate schemas at the edge using strict JSON schemas.
Enforce size limits for headers, bodies, and payload fields.
Normalize and encode output to prevent injection attacks.
Perform server-side validation even when clients validate.

Abuse Prevention and Availability#

Apply rate limits per identity, IP, and API key.
Enforce concurrency limits on expensive operations.
Introduce circuit breakers for downstream dependencies.
Use bot detection or behavioral analysis for public traffic.

Monitoring, Auditing, and Response#

Log authentication and authorization decisions with context.
Emit structured audit logs for privileged actions.
Alert on repeated access denials or abnormal spikes.
Document incident playbooks for credential rotation.

Node.js Example: Baseline Express Hardening#

The following Node.js example applies strict headers, request validation, and rate limiting.

import express from "express";
import helmet from "helmet";
import rateLimit from "express-rate-limit";

const app = express();

app.use(helmet());
app.use(express.json({ limit: "256kb" }));

app.use(
  rateLimit({
    windowMs: 60 * 1000,
    max: 120,
    standardHeaders: true,
    legacyHeaders: false,
  })
);

app.post("/payments", (req, res) => {
  if (!req.headers["x-request-id"]) {
    return res.status(400).json({ error: "Missing request id" });
  }
  return res.status(202).json({ status: "accepted" });
});

Conclusion#

A security checklist only works when enforced consistently. Automate these controls with gateways and policy-as-code so every API deployment inherits the same baseline protection.