api-security-best-practices

原文涵盖的主题

• API Security Best Practices
• Overview
• When to Use This Skill
• How It Works
• Step 1: Authentication & Authorization
• Step 2: Input Validation & Sanitization
• Step 3: Rate Limiting & Throttling
• Step 4: Data Protection

Guide developers in building secure APIs by implementing authentication, authorization, input validation, rate limiting, and protection against common vulnerabilities. This skill covers security patterns for REST, GraphQL, and WebSocket APIs. Use when designing new API endpoints Use when securing existing APIs Use when implementing authentication and authorization Use when protecting against API attacks (injection, DDoS, etc.) Use when conducting API security reviews Use when preparing for security audits Use when implementing rate limiting and throttling Use when handling sensitive data in APIs I'll help you implement secure authentication: Choose authentication method (JWT, OAuth 2.0, API keys) Implement token-based authentication Set up role-based access control (RBAC) Secure session management Implement multi-factor authentication (MFA) Protect against injection attacks: Validate all input data Sanitize user inputs Use parameterized queries Implement request schema validation Prevent SQL injection, XSS, and command injection Prevent abuse and DDoS attacks: Implement rate limiting per user/IP Set up API throttling Configure request quotas Handle rate limit errors gracefully Moni

这里只展示节选，请以完整原文和当前要求为准。