Api Security Hardening

secondsky/claude-skills/plugins/api-security-hardening/skills/api-security-hardening

作者 secondsky88378361314fMIT227 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫10 天前更新

REST API security hardening with authentication, rate limiting, input validation, security headers. Use for production APIs, security audits, defense-in-depth, or encountering vulnerabilities, injection attacks, CORS issues.

僅含說明Security

AI 產生的概覽

指導透過身分驗證、速率限制、輸入驗證與安全標頭來強化 REST API。

功能: 提供強化 REST API、防禦常見弱點的分層防護指引與程式碼模式。內容涵蓋 Express 中介軟體堆疊（Helmet、速率限制與清理）、使用 express-validator 的輸入驗證、安全標頭設定以及安全檢查清單。另指向一份參考檔案，說明 Python FastAPI 中介軟體、Pydantic 驗證、Nginx SSL/TLS 設定與 HTTP 參數污染防護。
適用情境: 適用於準備上線的正式環境 REST API、執行安全稽核或落實縱深防禦。也適合處理弱點、注入攻擊或 CORS 問題。
執行需求: 未附指令碼，僅為說明性內容。範例假定使用 Node.js 與 Express，以及 helmet、express-rate-limit、express-mongo-sanitize、express-validator 和 escape-html 等套件；參考檔案另涉及選用的 Python FastAPI 與 Nginx 設定。

API Security Hardening

Protect REST APIs against common vulnerabilities with multiple security layers.

Security Middleware Stack (Express)

javascript

const helmet = require('helmet');const rateLimit = require('express-rate-limit');const mongoSanitize = require('express-mongo-sanitize');
app.use(helmet());app.use(mongoSanitize());// For input sanitization, see the `xss-prevention` skill — do NOT use the// deprecated `xss-clean` package (unmaintained since 2018; its own README// recommends migrating off it).
app.use('/api/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 100}));
app.use('/api/auth/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 5}));

const helmet = require('helmet');const rateLimit = require('express-rate-limit');const mongoSanitize = require('express-mongo-sanitize');
app.use(helmet());app.use(mongoSanitize());// For input sanitization, see the `xss-prevention` skill — do NOT use the// deprecated `xss-clean` package (unmaintained since 2018; its own README// recommends migrating off it).
app.use('/api/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 100}));
app.use('/api/auth/', rateLimit({  windowMs: 15 * 60 * 1000,  max: 5}));

Input Validation

javascript

const { body, validationResult } = require('express-validator');const escapeHtml = require('escape-html');
app.post('/users',  body('email').isEmail().normalizeEmail(),  body('password').isLength({ min: 8 }).matches(/[A-Z]/).matches(/[0-9]/),  // express-validator v7+ removed the built-in .escape() sanitizer; use a  // customSanitizer backed by `escape-html` to HTML-escape the value.  body('name').trim().isLength({ max: 100 }).customSanitizer(v => escapeHtml(v)),  (req, res) => {    const errors = validationResult(req);    if (!errors.isEmpty()) {      return res.status(400).json({ errors: errors.array() });    }    // Process request  });

const { body, validationResult } = require('express-validator');const escapeHtml = require('escape-html');
app.post('/users',  body('email').isEmail().normalizeEmail(),  body('password').isLength({ min: 8 }).matches(/[A-Z]/).matches(/[0-9]/),  // express-validator v7+ removed the built-in .escape() sanitizer; use a  // customSanitizer backed by `escape-html` to HTML-escape the value.  body('name').trim().isLength({ max: 100 }).customSanitizer(v => escapeHtml(v)),  (req, res) => {    const errors = validationResult(req);    if (!errors.isEmpty()) {      return res.status(400).json({ errors: errors.array() });    }    // Process request  });

Security Headers

javascript

app.use((req, res, next) => {  res.setHeader('Content-Security-Policy', "default-src 'self'");  res.setHeader('X-Frame-Options', 'DENY');  res.setHeader('X-Content-Type-Options', 'nosniff');  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');  res.setHeader('X-XSS-Protection', '1; mode=block');  next();});

app.use((req, res, next) => {  res.setHeader('Content-Security-Policy', "default-src 'self'");  res.setHeader('X-Frame-Options', 'DENY');  res.setHeader('X-Content-Type-Options', 'nosniff');  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');  res.setHeader('X-XSS-Protection', '1; mode=block');  next();});

Security Checklist

HTTPS everywhere
Authentication on all protected routes
Input validation and sanitization
Rate limiting enabled
Security headers configured
CORS restricted to allowed origins
No stack traces in production errors
Audit logging enabled
Dependencies regularly updated

Additional Implementations

See references/python-nginx.md [blocked] for:

Python FastAPI security middleware
Pydantic input validation with password rules
Nginx SSL/TLS and security headers configuration
HTTP Parameter Pollution prevention

Never Do

Trust user input without validation
Return detailed errors in production
Store secrets in code
Use GET for state-changing operations
Disable security for convenience

來源與署名

來源：secondsky/claude-skills位於plugins/api-security-hardening/skills/api-security-hardening提交8837836

授權條款： MIT

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Api Security Hardening

API Security Hardening

Security Middleware Stack (Express)

Input Validation

Security Headers

Security Checklist

Additional Implementations

Never Do

來源與署名

更多來自 secondsky/claude-skills 的技能

Vulnerability Scanning

Web Performance Optimization

Web Performance Audit

Threejs

Tailwind V4 Shadcn

Technical Specification

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt