How would you secure a REST API end to end?
Answer
- TLS everywhere; HSTS.
- Authentication: OAuth 2.0/OIDC or short-lived JWT + refresh; validate signature,
exp, aud, iss, allowed algorithms. - Authorization on every request at object level (prevent IDOR); least privilege, scopes/roles.
- Validate input with schemas (Pydantic); parameterized queries; limit payload sizes.
- Rate limiting and abuse detection; MFA and lockout for login.
- Secrets in a secret manager; rotate keys.
- Safe error messages (no stack traces), security headers, strict CORS.
- Audit logs, dependency scanning, monitoring and alerts.
Practice this question in Repaso
