security Junior

How to secure APIs?

Short Answer

Secure APIs with HTTPS, authentication (Sanctum/Passport), rate limiting, input validation, CORS configuration, and proper error handling.

Detailed Answer

API security layers: 1. HTTPS: Always use SSL/TLS in production 2. Authentication: Sanctum tokens or Passport OAuth 3. Rate limiting: Throttle requests per user/IP 4. Input validation: Validate all input with Form Requests 5. CORS: Configure allowed origins properly 6. CSRF protection: Not for API routes (token-based auth) 7. Error handling: Don\'t expose stack traces in production 8. Authorization: Check user permissions (Policies/Gates) 9. Input sanitization: Prevent SQL injection and XSS 10. API versioning: Support multiple API versions Additional measures: - API keys for third-party access - Request signing for webhooks - IP whitelisting for admin endpoints - Audit logging for sensitive operations

Code Example

Example

<?php
// Rate limiting
Route::middleware(['auth:sanctum', 'throttle:60,1'])->group(function () {
    Route::apiResource('posts', PostController::class);
});

// Form Request validation
public function rules(): array
{
    return [
        'title' => ['required', 'string', 'max:255'],
        'body' => ['required', 'string', 'max:5000'],
    ];
}

// Authorization
$this->authorize('update', $post);

// CORS configuration
// config/cors.php
'allowed_origins' => ['https://frontend.com'],

// Safe error handling
report() => Log::error($e);
render() => response()->json(['error' => 'Server error'], 500);

How to secure APIs?

Short Answer

Detailed Answer

Code Example

Interview Tip