{"repo":"shieldfy/API-Security-Checklist","free":true,"listed":false,"github":"https://github.com/shieldfy/API-Security-Checklist","clone":"git clone https://github.com/shieldfy/API-Security-Checklist.git","description":"Checklist of the most important security countermeasures when designing, testing, and releasing your API","language":null,"stars":23299,"topics":["api","security","jwt","oauth2"],"license":"MIT","category":"auth-billing-email","readme_excerpt":"繁中版 简中版 العربية Azərbaycan Български বাংলা Català Čeština Deutsch Ελληνικά Español فارسی Français हिंदी Indonesia Italiano 日本語 한국어 ພາສາລາວ Македонски മലയാളം Монгол Nederlands Polski Português (Brasil) Русский ไทย Türkçe Українська Tiếng Việt API Security Checklist Checklist of the most important security countermeasures when designing, testing, and releasing your API. --- Authentication - [ ] Don't use Basic Auth . Use standard authentication instead. - [ ] Don't reinvent the wheel in Authentication , token generation , password storage . Use the standards. - [ ] Use Max Retry and jail features in Login. - [ ] Use encryption on all sensitive data. Access - [ ] Limit requests (Throttling) to avoid DDoS / brute-force attacks. - [ ] Use HTTPS on server side with TLS 1.2+ and secure ciphers to avoid MITM (Man in the Middle Attack) and ensure Host header matches the SNI. - [ ] Use HSTS header with SSL to avoid SSL Strip attacks. - [ ] Turn off directory listings. - [ ] For private APIs, allow access only from safelisted IPs/hosts. Authorization OAuth - [ ] Always validate redirect uri server-side to allow only safelisted URLs. - [ ] Always try to exchange for code and not tokens (don't allow response type=token ). - [ ] Use state parameter with a random hash to prevent CSRF on the OAuth authorization process. - [ ] Define the default scope, and validate scope parameters for each application. Input - [ ] Use the proper HTTP method according to the operation: GET (read) , POST (crea","default_branch":null,"files":null,"tree":[],"storefront":"/r/shieldfy","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/shieldfy/API-Security-Checklist/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}