Api Security Hardening

作者 secondsky88378361314fMIT227 个星标收录于 2026年10月8日更新于 2026年10月8日仓库10天前更新

REST API security hardening with authentication, rate limiting, input validation, security headers. Use for production APIs, security audits, defense-in-depth, or encountering vulnerabilities, injection attacks, CORS issues.

仅含说明Security

AI 生成的概览

指导通过身份验证、速率限制、输入验证和安全响应头来加固 REST API。

功能: 提供用于加固 REST API、防御常见漏洞的分层防护指导与代码模式。内容涵盖基于 Express 的中间件栈（Helmet、速率限制与清理）、使用 express-validator 的输入验证、安全响应头配置以及安全检查清单。还指向一个参考文件，介绍 Python FastAPI 中间件、Pydantic 验证、Nginx SSL/TLS 配置和 HTTP 参数污染防护。
适用场景: 适用于准备上线的生产 REST API、执行安全审计或实施纵深防御的场景。也适用于处理漏洞、注入攻击或 CORS 问题。
运行要求: 不附带脚本，仅为说明性内容。示例假定使用 Node.js 与 Express，以及 helmet、express-rate-limit、express-mongo-sanitize、express-validator 和 escape-html 等包；参考文件还涉及可选的 Python FastAPI 与 Nginx 配置。

API Security Hardening

Protect REST APIs against common vulnerabilities with multiple security layers.

Security Middleware Stack (Express)

javascript

const helmet = require('helmet');const rateLimit = require('express-rate-limit');const mongoSanitize = require('express-mongo-sanitize');
app.use(helmet());app.use(mongoSanitize());// For input sanitization, see the `xss-prevention` skill — do NOT use the// deprecated `xss-clean` package (unmaintained since 2018; its own README// recommends migrating off it).
app.use('/api/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 100}));
app.use('/api/auth/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 5}));

const helmet = require('helmet');const rateLimit = require('express-rate-limit');const mongoSanitize = require('express-mongo-sanitize');
app.use(helmet());app.use(mongoSanitize());// For input sanitization, see the `xss-prevention` skill — do NOT use the// deprecated `xss-clean` package (unmaintained since 2018; its own README// recommends migrating off it).
app.use('/api/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 100}));
app.use('/api/auth/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 5}));

Input Validation

javascript

const { body, validationResult } = require('express-validator');const escapeHtml = require('escape-html');
app.post('/users',  body('email').isEmail().normalizeEmail(),  body('password').isLength({ min: 8 }).matches(/[A-Z]/).matches(/[0-9]/),  // express-validator v7+ removed the built-in .escape() sanitizer; use a  // customSanitizer backed by `escape-html` to HTML-escape the value.  body('name').trim().isLength({ max: 100 }).customSanitizer(v => escapeHtml(v)),  (req, res) => {    const errors = validationResult(req);    if (!errors.isEmpty()) {      return res.status(400).json({ errors: errors.array() });    }    // Process request  });

const { body, validationResult } = require('express-validator');const escapeHtml = require('escape-html');
app.post('/users',  body('email').isEmail().normalizeEmail(),  body('password').isLength({ min: 8 }).matches(/[A-Z]/).matches(/[0-9]/),  // express-validator v7+ removed the built-in .escape() sanitizer; use a  // customSanitizer backed by `escape-html` to HTML-escape the value.  body('name').trim().isLength({ max: 100 }).customSanitizer(v => escapeHtml(v)),  (req, res) => {    const errors = validationResult(req);    if (!errors.isEmpty()) {      return res.status(400).json({ errors: errors.array() });    }    // Process request  });

Security Headers

javascript

app.use((req, res, next) => {  res.setHeader('Content-Security-Policy', "default-src 'self'");  res.setHeader('X-Frame-Options', 'DENY');  res.setHeader('X-Content-Type-Options', 'nosniff');  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');  res.setHeader('X-XSS-Protection', '1; mode=block');  next();});

app.use((req, res, next) => {  res.setHeader('Content-Security-Policy', "default-src 'self'");  res.setHeader('X-Frame-Options', 'DENY');  res.setHeader('X-Content-Type-Options', 'nosniff');  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');  res.setHeader('X-XSS-Protection', '1; mode=block');  next();});

Security Checklist

HTTPS everywhere
Authentication on all protected routes
Input validation and sanitization
Rate limiting enabled
Security headers configured
CORS restricted to allowed origins
No stack traces in production errors
Audit logging enabled
Dependencies regularly updated

Additional Implementations

See references/python-nginx.md [blocked] for:

Python FastAPI security middleware
Pydantic input validation with password rules
Nginx SSL/TLS and security headers configuration
HTTP Parameter Pollution prevention

Never Do

Trust user input without validation
Return detailed errors in production
Store secrets in code
Use GET for state-changing operations
Disable security for convenience

来源与署名

来源：secondsky/claude-skills位于plugins/api-security-hardening/skills/api-security-hardening提交8837836

许可证： MIT

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Api Security Hardening

API Security Hardening

Security Middleware Stack (Express)

Input Validation

Security Headers

Security Checklist

Additional Implementations

Never Do

来源与署名

更多来自 secondsky/claude-skills 的技能

Vulnerability Scanning

Web Performance Optimization

Web Performance Audit

Threejs

Tailwind V4 Shadcn

Technical Specification

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt