Practical web/API security: auth, sessions, rate limits, and input handling

Security begins with ordinary mistakes#

Many incidents come from simple failures: committed tokens, admin endpoints without authorization, unvalidated input, unsafe session cookies, sensitive data in logs, or APIs returning too many fields.

Authentication vs authorization#

Authentication answers who the user is. Authorization answers what the user may do. A logged-in user should not automatically be allowed to edit every post, view every order, or call every admin endpoint.

Session cookies and JWTs#

Session cookies work well for browser dashboards. Use HttpOnly, Secure, SameSite, and reasonable expiration. JWTs can work well for APIs or service-to-service verification, but revocation and permission changes require careful design.

Allowlist validation#

Validate type, length, format, enum values, and relationships. For HTML content, sanitize scripts, event handlers, and dangerous URLs.

type PostInput = {
  title: string;
  slug: string;
  content: string;
  published_at: string | null;
};

function isValidSlug(value: string) {
  return /^[a-z0-9-]+$/.test(value) && value.length <= 120;
}

Output filtering#

Public APIs should return only public fields. For example, comments may store author email for moderation, but public routes should expose only approved author name, content, and timestamps.

Rate limiting and secrets#

Login, contact, comment, search, upload, and AI-generation endpoints need abuse protection. Secrets should never be committed, bundled into frontend JavaScript, or written to logs. Rotate keys when exposure is suspected.

Security checklist#

• Every sensitive mutation checks authentication and authorization server-side.
• Session cookies use HttpOnly, Secure, SameSite, and expiration.
• Inputs are validated with allowlists and length limits.
• Public APIs do not return sensitive fields.
• Abuse-prone endpoints have rate limits.
• Secrets stay out of Git, frontend bundles, and logs.
• Admin actions are audit logged.

Primary references#

• OWASP API Security Top 10 2023
• MDN: Set-Cookie header
• MDN: Content Security Policy