Loading
Topic
CORS, CSRF, rate limiting, overposting, safe errors, secrets, security headers, TLS, and browser/API hardening.
Practice items tagged with API Security Protection.
Partitions limits by authenticated user or trusted client address and returns useful 429 retry metadata.
Explains rate-limit identity, endpoint cost, login and suggestion throttles, Redis counters, user experience, and observability.
Loads a resource once, evaluates owner-or-capability authorization, and avoids trusting route ownership claims.
Explains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.
Explains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.
Validates size and signature, writes under a generated storage key, and keeps untrusted files outside the public web root.