api-security-best-practices

Name: api-security-best-practices
Author: SamarthaKV29

64stars12forks

How to install api-security-best-practices?

samarthakv29/antigravity-god-mode/api-security-best-practices

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill api-security-best-practices

Installs into the current project.

Summary

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Files · 1

View on GitHub

SKILL.md

1	# API Security Best Practices
2
3	## Overview
4
5	Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs.
6
7	## When to Use This Skill
8
9	- Use when designing new API endpoints
10	- Use when securing existing APIs
11	- Use when implementing authentication and authorization
12	- Use when protecting against API attacks (injection, DDoS, etc.)
13	- Use when conducting API security reviews
14	- Use when preparing for security audits
15	- Use when implementing rate limiting and throttling
16	- Use when handling sensitive data in APIs
17
18	## How It Works
19
20	### Step 1: Authentication & Authorization
21
22	I'll help you implement secure authentication:
23	- Choose authentication method (JWT, OAuth 2.0, API keys)
24	- Implement token-based authentication
25	- Set up role-based access control (RBAC)
26	- Secure session management
27	- Implement multi-factor authentication (MFA)
28
29	### Step 2: Input Validation & Sanitization
30
31	Protect against injection attacks:
32	- Validate all input data
33	- Sanitize user inputs
34	- Use parameterized queries
35	- Implement request schema validation
36	- Prevent SQL injection, XSS, and command injection
37
38	### Step 3: Rate Limiting & Throttling
39
40	Prevent abuse and DDoS attacks:
41	- Implement rate limiting per user/IP
42	- Set up API throttling
43	- Configure request quotas
44	- Handle rate limit errors gracefully
45	- Monitor for suspicious activity
46
47	### Step 4: Data Protection
48
49	Secure sensitive data:
50	- Encrypt data in transit (HTTPS/TLS)
51	- Encrypt sensitive data at rest
52	- Implement proper error handling (no data leaks)
53	- Sanitize error messages
54	- Use secure headers
55
56	### Step 5: API Security Testing
57
58	Verify security implementation:
59	- Test authentication and authorization
60	- Perform penetration testing
61	- Check for common vulnerabilities (OWASP API Top 10)
62	- Validate input handling
63	- Test rate limiting
64
65
66	## Examples
67
68	### Example 1: Implementing JWT Authentication
69
70	```markdown
71	## Secure JWT Authentication Implementation
72
73	### Authentication Flow
74
75	1. User logs in with credentials
76	2. Server validates credentials
77	3. Server generates JWT token
78	4. Client stores token securely
79	5. Client sends token with each request
80	6. Server validates token
81
82	### Implementation
83
84	#### 1. Generate Secure JWT Tokens
85
86	\`\`\`javascript
87	// auth.js
88	const jwt = require('jsonwebtoken');
89	const bcrypt = require('bcrypt');
90
91	// Login endpoint
92	app.post('/api/auth/login', async (req, res) => {
93	try {
94	const { email, password } = req.body;
95
96	// Validate input
97	if (!email \|\| !password) {
98	return res.status(400).json({
99	error: 'Email and password are required'
100	});
101	}
102
103	// Find user
104	const user = await db.user.findUnique({
105	where: { email }
106	});
107
108	if (!user) {
109	// Don't reveal if user exists
110	return res.status(401).json({
111	error: 'Invalid credentials'
112	});
113	}
114
115	// Verify password
116	const validPassword = await bcrypt.compare(
117	password,
118	user.passwordHash
119	);
120
121	if (!validPassword) {
122	return res.status(401).json({
123	error: 'Invalid credentials'
124	});
125	}
126
127	// Generate JWT token
128	const token = jwt.sign(
129	{
130	userId: user.id,
131	email: user.email,
132	role: user.role
133	},
134	process.env.JWT_SECRET,
135	{
136	expiresIn: '1h',
137	issuer: 'your-app',
138	audience: 'your-app-users'
139	}
140	);
141
142	// Generate refresh token
143	const refreshToken = jwt.sign(
144	{ userId: user.id },
145	process.env.JWT_REFRESH_SECRET,
146	{ expiresIn: '7d' }
147	);
148
149	// Store refresh token in database
150	await db.refreshToken.create({
151	data: {
152	token: refreshToken,
153	userId: user.id,
154	expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000)
155	}
156	});
157
158	res.json({
159	token,
160	refreshToken,
161	expiresIn: 3600
162	});
163
164	} catch (error) {
165	console.error('Login error:', error);
166	res.status(500).json({
167	error: 'An error occurred during login'
168	});
169	}
170	});
171	\`\`\`
172
173	#### 2. Verify JWT Tokens (Middleware)
174
175	\`\`\`javascript
176	// middleware/auth.js
177	const jwt = require('jsonwebtoken');
178
179	function authenticateToken(req, res, next) {
180	// Get token from header
181	const authHeader = req.headers['authorization'];
182	const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN
183
184	if (!token) {
185	return res.status(401).json({
186	error: 'Access token required'
187	});
188	}
189
190	// Verify token
191	jwt.verify(
192	token,
193	process.env.JWT_SECRET,
194	{
195	issuer: 'your-app',
196	audience: 'your-app-users'
197	},
198	(err, user) => {
199	if (err) {
200	if (err

People who liked this also viewed

6 picks

Type

api-security-best-practices

64stars12forks

View on GitHub

How to install api-security-best-practices?

samarthakv29/antigravity-god-mode/api-security-best-practices

$npx -y skills add SamarthaKV29/antigravity-god-mode --skill api-security-best-practices

Installs into the current project.

Summary

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Files · 1

View on GitHub

SKILL.md

1	# API Security Best Practices
2
3	## Overview
4
5	Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs.
6
7	## When to Use This Skill
8
9	- Use when designing new API endpoints
10	- Use when securing existing APIs
11	- Use when implementing authentication and authorization
12	- Use when protecting against API attacks (injection, DDoS, etc.)
13	- Use when conducting API security reviews
14	- Use when preparing for security audits
15	- Use when implementing rate limiting and throttling
16	- Use when handling sensitive data in APIs
17
18	## How It Works
19
20	### Step 1: Authentication & Authorization
21
22	I'll help you implement secure authentication:
23	- Choose authentication method (JWT, OAuth 2.0, API keys)
24	- Implement token-based authentication
25	- Set up role-based access control (RBAC)
26	- Secure session management
27	- Implement multi-factor authentication (MFA)
28
29	### Step 2: Input Validation & Sanitization
30
31	Protect against injection attacks:
32	- Validate all input data
33	- Sanitize user inputs
34	- Use parameterized queries
35	- Implement request schema validation
36	- Prevent SQL injection, XSS, and command injection
37
38	### Step 3: Rate Limiting & Throttling
39
40	Prevent abuse and DDoS attacks:
41	- Implement rate limiting per user/IP
42	- Set up API throttling
43	- Configure request quotas
44	- Handle rate limit errors gracefully
45	- Monitor for suspicious activity
46
47	### Step 4: Data Protection
48
49	Secure sensitive data:
50	- Encrypt data in transit (HTTPS/TLS)
51	- Encrypt sensitive data at rest
52	- Implement proper error handling (no data leaks)
53	- Sanitize error messages
54	- Use secure headers
55
56	### Step 5: API Security Testing
57
58	Verify security implementation:
59	- Test authentication and authorization
60	- Perform penetration testing
61	- Check for common vulnerabilities (OWASP API Top 10)
62	- Validate input handling
63	- Test rate limiting
64
65
66	## Examples
67
68	### Example 1: Implementing JWT Authentication
69
70	```markdown
71	## Secure JWT Authentication Implementation
72
73	### Authentication Flow
74
75	1. User logs in with credentials
76	2. Server validates credentials
77	3. Server generates JWT token
78	4. Client stores token securely
79	5. Client sends token with each request
80	6. Server validates token
81
82	### Implementation
83
84	#### 1. Generate Secure JWT Tokens
85
86	\`\`\`javascript
87	// auth.js
88	const jwt = require('jsonwebtoken');
89	const bcrypt = require('bcrypt');
90
91	// Login endpoint
92	app.post('/api/auth/login', async (req, res) => {
93	try {
94	const { email, password } = req.body;
95
96	// Validate input
97	if (!email \|\| !password) {
98	return res.status(400).json({
99	error: 'Email and password are required'
100	});
101	}
102
103	// Find user
104	const user = await db.user.findUnique({
105	where: { email }
106	});
107
108	if (!user) {
109	// Don't reveal if user exists
110	return res.status(401).json({
111	error: 'Invalid credentials'
112	});
113	}
114
115	// Verify password
116	const validPassword = await bcrypt.compare(
117	password,
118	user.passwordHash
119	);
120
121	if (!validPassword) {
122	return res.status(401).json({
123	error: 'Invalid credentials'
124	});
125	}
126
127	// Generate JWT token
128	const token = jwt.sign(
129	{
130	userId: user.id,
131	email: user.email,
132	role: user.role
133	},
134	process.env.JWT_SECRET,
135	{
136	expiresIn: '1h',
137	issuer: 'your-app',
138	audience: 'your-app-users'
139	}
140	);
141
142	// Generate refresh token
143	const refreshToken = jwt.sign(
144	{ userId: user.id },
145	process.env.JWT_REFRESH_SECRET,
146	{ expiresIn: '7d' }
147	);
148
149	// Store refresh token in database
150	await db.refreshToken.create({
151	data: {
152	token: refreshToken,
153	userId: user.id,
154	expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000)
155	}
156	});
157
158	res.json({
159	token,
160	refreshToken,
161	expiresIn: 3600
162	});
163
164	} catch (error) {
165	console.error('Login error:', error);
166	res.status(500).json({
167	error: 'An error occurred during login'
168	});
169	}
170	});
171	\`\`\`
172
173	#### 2. Verify JWT Tokens (Middleware)
174
175	\`\`\`javascript
176	// middleware/auth.js
177	const jwt = require('jsonwebtoken');
178
179	function authenticateToken(req, res, next) {
180	// Get token from header
181	const authHeader = req.headers['authorization'];
182	const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN
183
184	if (!token) {
185	return res.status(401).json({
186	error: 'Access token required'
187	});
188	}
189
190	// Verify token
191	jwt.verify(
192	token,
193	process.env.JWT_SECRET,
194	{
195	issuer: 'your-app',
196	audience: 'your-app-users'
197	},
198	(err, user) => {
199	if (err) {
200	if (err

People who liked this also viewed

6 picks

Type