API Security
Focused api security articles with clear context, practical examples, source links where needed, and honest limits.
10 articles in this section.
Audit logs that attackers cannot silently rewrite
A tamper-evident log links ordered records with hashes and stores checkpoints outside the writer’s normal mutation path.
File upload security: inspect content, not only extensions
A filename and Content-Type header are caller-controlled, so uploads need size limits, safe storage names, content inspection, and isolated processing.
Cursor pagination tokens: sign filters and sort state
An opaque cursor should encode the stable sort position and relevant query state so clients cannot alter hidden filters or page across inconsistent ordering.
Multi-tenant API authorization: never trust tenant_id from JSON
Tenant identity must come from authenticated authorization context and constrain every query, not from a caller-controlled request field.
Refresh token rotation: detect reuse without logging everyone out
Rotating refresh tokens limits replay when the server tracks token families and treats reuse of an old member as a compromise signal.
202 Accepted APIs: job status, retries, and cancellation
A 202 response means work was accepted, not completed, so return a durable job URL and define terminal failure, expiry, and cancellation states.
Problem Details RFC 9457: consistent API errors
Problem Details gives errors a stable media type and fields, but applications still need safe extension names and machine-readable domain codes.
Optimistic concurrency with ETags and If-Match
ETags let an API reject an update based on stale state instead of silently overwriting another user’s newer change.
API idempotency keys: store status codes and response bodies
A completed idempotency record should replay the original status and response, while an in-progress record should prevent concurrent execution.
Webhook replay protection: timestamp windows and event IDs
A valid signature proves message integrity, not freshness, so webhook receivers also need a timestamp window and durable event deduplication.