Developer Reference Guide

API Security Checklist (2026)

Essential developer checklist for securing REST, GraphQL, and gRPC endpoints before pushing to production. Focus on authorization boundaries, token integrity, and rate limiting.

OWASP API Security Top 10 Verification Modules

REST • GraphQL • gRPC

1. Authentication & Session Security

Enforce HTTPS/TLS 1.3 on all API endpoints; redirect HTTP traffic automatically.

Store JWTs in HTTP-Only, SameSite=Strict cookies rather than localStorage to prevent XSS exfiltration.

Use asymmetric RS256/ES256 algorithms with strong 2048-bit RSA keys; reject 'none' algorithm tokens.

Implement mandatory refresh token rotation and short (15-min) access token TTLs with revocation blacklists.

2. Authorization & Tenant Isolation (BOLA / BFLA)

Verify row-level tenant ownership (req.user.tenantId === record.tenantId) on every endpoint before database queries.

Ensure object IDs (UUID v4) cannot be enumerated or guessed to access unauthorized customer records.

Validate role-based access control (RBAC) on administrative endpoints; reject privilege escalation attempts.

Prevent Broken Object Property Level Authorization by filtering input DTO payloads with strict schema validators.

3. Input Validation & Rate Limiting

Sanitize all JSON payloads, query parameters, and headers against injection (SQLi, NoSQLi, Command Injection).

Implement Redis-backed sliding window rate-limiting per IP and user ID to mitigate automated credential stuffing.

Restrict payload body size (e.g., max 1MB) and timeout parameters to prevent memory starvation attacks.

Configure strict CORS policies; avoid Access-Control-Allow-Origin: * on authenticated microservice APIs.

4. Logging, Secrets & Infrastructure Defense

Mask all sensitive data (passwords, payment card numbers, PII) in application logs and observability collectors.

Never commit API keys, cloud secrets, or private keys to source control; use secret management vaults.

Disable stack traces and verbose error messages in production responses; return generic error envelopes.

Enforce automated dependency vulnerability scanning (Snyk / Dependabot) in your CI/CD deployment pipelines.

How to Remediate BOLA in Multi-Tenant Backend APIs

Broken Object Level Authorization (BOLA/IDOR) is responsible for over 40% of critical API data breaches. To eliminate BOLA, never query database models using URL parameters alone. Instead, always couple the requested resource identifier with the authenticated user's tenant ID retrieved directly from the verified session token or signed JWT context.

// Secure Pattern: Always scope queries by authenticated tenant context

const order = await db.orders.findOne({

_id: req.params.orderId,

tenantId: req.user.tenantId // Enforce tenant boundary!

});

if (!order) return res.status(404).json({ error: 'Order not found' });

Offensive API Security Practice

Need a Manual API Penetration Test?

Our offensive security practitioners manually test your APIs for BOLA, authentication flaws, and business logic bypasses in 5 to 7 days. Explore our API Security Testing & BOLA Pentesting services or schedule a scoping conversation.

Get Free Scoping Review View Sample Report