Practical defences.
WHAT TO REQUIRE ABSOLUTELY
Encrypted connections, with unencrypted requests refused rather than redirected.
WHY REFUSED
A redirect means the credential was already sent in the clear.
WHAT TO VALIDATE
Every input, against an expected shape.
WHAT TO REJECT
Unexpected fields, where strictness is appropriate Values outside permitted ranges Payloads beyond a size limit
WHY SIZE LIMITS MATTER
An enormous payload consumes memory before you examine it.
WHAT TO LIMIT
Requests per caller Concurrent requests Expensive operations specifically
WHAT TO PROTECT AGAINST
Injection, by parameterising everything Enumeration, by not exposing sequential identifiers Excessive data exposure, by returning only what is needed
WHY THAT LAST ONE MATTERS
Returning a whole record and filtering in the client exposes everything.
WHAT TO CHECK IN RESPONSES
That no field leaks internal or other users' data.
WHAT TO DISABLE
Verbose errors in production Endpoints that exist only for development
WHAT TO ROTATE
Keys and secrets, on a schedule and after any departure.
WHAT TO MONITOR
Authentication failures Unusual patterns from one caller Requests to endpoints that should be rare
WHAT TO PREPARE
A way to revoke a caller's access immediately.
