API Security Best Practices for Modern Web Apps

Why API Security Matters

Modern web applications expose dozens, sometimes hundreds, of API endpoints. Each endpoint is a potential entry point for attackers. According to our scan data, over 60% of APIs have at least one security misconfiguration.

The OWASP API Security Top 10

Here are the most critical API risks, based on our real-world scan data:

Rank	Risk	Prevalence in Scans
1	Broken Object Level Authorization	45%
2	Broken Authentication	38%
3	Excessive Data Exposure	52%
4	Lack of Resources & Rate Limiting	61%
5	Broken Function Level Authorization	33%

API Security Checklist

1. Authenticate Every Request

// ❌ BAD: Public endpoint with sensitive data
app.get('/api/users', (req, res) => {
  const users = db.findAllUsers();
  res.json(users);
});

// ✅ GOOD: Authenticated endpoint with proper authorization
app.get('/api/users', authenticate, authorize('admin'), (req, res) => {
  const users = db.findUsersByTenant(req.user.tenantId);
  res.json(users.map(sanitizeUser));
});

2. Implement Rate Limiting

import rateLimit from 'express-rate-limit';

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 100,                    // max 100 requests per window
  standardHeaders: true,
  message: { error: 'Too many requests' }
});

app.use('/api/', apiLimiter);

3. Validate Input at the Gateway

Don't trust any input, even from authenticated users:

Use Zod or Joi for schema validation
Strip unexpected fields from request bodies
Validate content types

4. Never Expose Internal IDs

- { "id": "user_12345", "email": "alice@example.com" }
+ { "id": "usr_a1b2c3d4", "email": "alice@example.com" }

Use UUIDs or random identifiers instead of sequential integers.

GraphQL-Specific Risks

GraphQL adds unique security challenges:

Introspection queries can reveal your entire schema — disable in production
Depth-based attacks — complex nested queries can DDoS your backend
Batched queries — attackers can query thousands of records in a single request

Sentinel's scan checks for exposed GraphQL introspection endpoints, missing query depth limits, and batching vulnerabilities.

Summary

API security is a multi-layered discipline. Authenticate everything, rate-limit aggressively, validate inputs strictly, and never expose more data than necessary. Use Sentinel to scan your API endpoints for common misconfigurations.