API Security Best Practices: OAuth2, JWT, and Rate Limiting

/Why APIs Are the New Frontline

Modern applications expose far more API surface than UI. Automated scraping, credential stuffing, and logic abuse target endpoints that traditional web firewalls cannot understand. API security requires validating intent at the application layer, not just the network edge.

/OAuth2: Delegating Access Safely

OAuth 2.1 consolidates the current best-practice flows. Use the Authorization Code flow with PKCE for all public clients (SPAs, mobile). Never use the Implicit flow (deprecated) and never expose the Client Secret in browser code. Short-lived access tokens with refresh tokens are the standard pattern.

• Use Authorization Code + PKCE for browser and mobile clients
• Issue short-lived access tokens (15 min) and rotating refresh tokens
• Store tokens securely: HttpOnly cookies for web, secure storage for mobile
• Validate redirect URIs exactly — never allow open redirects
• Scope tokens to the least privilege required for each client

/JWT Validation Pitfalls

JSON Web Tokens are stateless and tamper-evident, but misconfigured validation leads to complete authentication bypass. The most common — and most dangerous — mistakes involve the algorithm and signature checks.

INSECURE (do not do this):
  // Trusts the alg from the header -> "alg:none" attack
  jwt.verify(token, publicKey)

SECURE:
  // Pin the expected algorithms explicitly
  jwt.verify(token, publicKey, { algorithms: ['RS256'] })

Always pin the allowed algorithms, verify the signature with the correct key, check `iss` (issuer), `aud` (audience), `exp` (expiry), and `nbf` (not-before). Reject unsigned tokens. Validate the `kid` header to prevent key-confusion attacks.

/Rate Limiting and Abuse Prevention

Rate limiting protects against brute force, scraping, and denial-of-service. Effective limiting is layered: per-IP limits at the edge, per-user/per-token limits at the application, and anomaly detection for behavioral abuse.

# Layered limits
edge:       100 req / 10s per IP
auth:       5  attempts / 15s per IP + per-user
api:        300 req / min per token
write:      60  mutations / min per token

/Input Validation and Mass Assignment

Validate every field against an explicit schema (e.g., Zod). Mass assignment — binding client JSON directly onto a model — lets attackers overwrite fields like `role` or `isAdmin`. Use DTOs that list exactly the fields a caller may set, and reject unknown keys.

“A correctly signed JWT proves who the caller is; it says nothing about what they are allowed to do. Authorization is a separate, per-object check on every request.”

Our API assessment includes manual SQL-injection testing, CORS analysis, endpoint fuzzing, and OAuth2/JWT logic verification across the OWASP API Top 10. Request an audit to harden your API surface.