How to secure a REST API

Authentication

Identify callers using tokens (JWT, opaque), API keys, or OAuth 2.0. Avoid sending credentials in URLs. Validate tokens on every request with short expiration times.

Authorization

Authentication proves identity; authorization decides access. Implement role-based access control (RBAC) or attribute-based access control (ABAC). See authentication vs authorization for a detailed distinction, and how to implement role-based access control for design patterns.

Input Validation

Reject malformed data before it reaches business logic. Use strict schemas, parameterized queries, and rate limiting to prevent injection and brute force.

Transport and Headers

Require TLS for all endpoints. Add security headers:

Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'none'
X-Content-Type-Options: nosniff

For header details, see how to implement Content Security Policy headers. Logging and monitoring complete the defense strategy.