Back to Home
Free Security Resource
API Security Checklist (2026)
Essential developer checklist for securing REST, GraphQL, and gRPC endpoints before pushing to production.
1. Authentication & Session Security
Enforce HTTPS/TLS 1.3 on all API endpoints; redirect HTTP traffic automatically.
Store JWTs in HTTP-Only, SameSite=Strict cookies rather than localStorage.
Use asymmetric RS256/ES256 algorithms with strong 2048-bit RSA keys.
Implement mandatory refresh token rotation and short (15-min) access token TTLs.
2. Authorization & Tenant Isolation (BOLA / BFLA)
Verify row-level tenant ownership (req.user.tenantId === record.tenantId) on every endpoint.
Ensure object IDs (UUID v4) cannot be enumerated to access unauthorized records.
Validate role-based access control (RBAC) on administrative endpoints.
Prevent Broken Object Property Level Authorization by filtering input DTO payloads.
3. Input Validation & Rate Limiting
Sanitize all JSON payloads, query parameters, and headers against injection (SQLi, XSS, Command Injection).
Implement Redis-backed sliding window rate-limiting per IP and user ID.
Restrict payload body size (e.g., max 1MB) to mitigate denial of service.
Configure strict CORS policies; avoid Access-Control-Allow-Origin: * on authenticated APIs.
Need a Manual API Penetration Test?
Our OSCP-certified security engineers manually test your APIs for BOLA, authentication flaws, and logic bypasses in 5 to 7 days.