api-security-best-practices

Generate a signed JWT on login with a short expiration, then verify it in middleware using the Authorization Bearer header. Store refresh tokens in a database so they can be revoked, and validate the token issuer and audience claims.

Use parameterized queries or an ORM like Prisma instead of string concatenation in SQL statements. Validate input types and formats first, for example checking that an ID parameter matches expected numeric patterns before querying.

Apply a strict limiter such as 5 attempts per 15 minutes on authentication routes, skipping successful requests so legitimate users are not penalized. Use a Redis store so limits persist across multiple server instances.

Yes, the security patterns apply to REST, GraphQL, and WebSocket APIs. Core controls like authentication, input validation, rate limiting, and secure error handling are protocol-agnostic, though implementation details differ per framework.

Verbose errors leak internal details like database constraints, stack traces, and schema names that attackers use for reconnaissance. Return generic client-facing messages while logging full error details server-side for debugging.

JWT payloads are base64-encoded, not encrypted, so anyone holding the token can read its contents. Never store passwords or sensitive data in the payload, and keep tokens short-lived since they cannot be individually revoked without a blacklist.