2.3 KiB
2.3 KiB
API Security Review Checklist
Security-focused review for API endpoints.
Authentication & Authorization
- JWT required on all protected endpoints
- Token expiration enforced
- Superuser flag checked for admin operations
- No authentication bypass vulnerabilities
- Session management secure
Multi-Tenant Security
- All queries filter by
tenant_id - No cross-tenant data leaks possible
- Repository pattern enforces isolation
- Admin endpoints verify superuser
- Test cases prove isolation
Input Validation
- All inputs validated with Pydantic
- SQL injection prevented (using ORM)
- XSS prevented (output encoding)
- File uploads validated (type, size)
- Email format validated
- URL format validated
- Integer ranges validated
- String lengths validated
Sensitive Data
- Passwords hashed with bcrypt
- Password hashes never returned
- Secrets from Doppler (not hardcoded)
- PII properly handled
- No sensitive data in logs
- No sensitive data in error messages
Rate Limiting
- Public endpoints rate limited
- Login endpoints strictly rate limited
- Rate limit uses Redis
- Rate limit tested
CORS
- Allowed origins from Doppler
- No
allow_origins=["*"]in production - Credentials allowed only for trusted origins
- Preflight requests handled
Error Handling
- No stack traces in production responses
- Generic errors for security issues
- Detailed errors only in dev/test
- Errors logged server-side
OWASP Top 10
- A01: Broken Access Control - ✅ Tenant isolation
- A02: Cryptographic Failures - ✅ Bcrypt, Doppler
- A03: Injection - ✅ ORM, validation
- A04: Insecure Design - ✅ Repository pattern
- A05: Security Misconfiguration - ✅ CORS, secrets
- A06: Vulnerable Components - ✅ Updated dependencies
- A07: Identification Failures - ✅ JWT, rate limiting
- A08: Integrity Failures - ✅ Input validation
- A09: Logging Failures - ✅ Error logging
- A10: SSRF - ✅ URL validation
Before Production Deploy
- Security scan passed
- No hardcoded secrets
- Doppler secrets configured
- CORS origins configured
- Rate limiting enabled
- HTTPS enforced
- Error handling tested
- Penetration test completed