Security Defense in Depth:
1. Authentication & Token Security:
- Enforce HTTPS/TLS everywhere. Use strong token standards (JWT with asymmetric RS256 or ephemeral opaque tokens) with short lifespans.
- Prevent brute-force attacks by rate-limiting authentication endpoints by IP and account ID.
2. Injection Defense (SQLi, NoSQLi, Command Injection):
- Use parameterized queries, prepared statements, and trusted ORMs. Never concatenate raw user input into SQL strings.
- Enforce strict input validation using schema validators (Zod / Joi), rejecting unexpected fields.
3. Broken Object Level Authorization (BOLA / IDOR):
- The #1 API vulnerability. Never trust client-provided IDs blindly (/api/documents/:id). Always verify in the datastore that the authenticated session (req.user.uid) owns or has explicit permission to access the requested record.
4. Rate Limiting & DoS Protection:
- Apply global and per-user rate limits at the API gateway layer.
- Enforce JSON body size limits (e.g., 100kb for standard REST, 5MB for multi-image uploads) to prevent heap exhaustion.
5. Security Headers & CORS:
- Configure strict CORS allow-lists, Content-Security-Policy, X-Content-Type-Options: nosniff, and disable stack trace leakage in 500 error responses.