OWASP Top 10 for APIs

// Pattern: validate -> authenticate -> authorize -> handler
app.get("/orders/:id", async (req, res) => {
  const user = requireAuth(req);
  const orderId = z.string().uuid().parse(req.params.id);
  const order = await ordersRepo.findById(orderId);
  if (!order || order.tenantId !== user.tenantId) {
    return res.status(404).json({ error: "Not found" });
  }
  res.json(order);
});

import express from "express";
import rateLimit from "express-rate-limit";
import { z } from "zod";
import helmet from "helmet";
 
class HttpError extends Error {
  constructor(public status: number, message: string) {
    super(message);
  }
}
 
const usersRepo = {
  async update(id: string, patch: { name: string }) {
    return { id, ...patch };
  },
};
 
const app = express();
app.use(helmet());
app.use(express.json({ limit: "1mb" }));
 
const authLimiter = rateLimit({ windowMs: 60_000, max: 10 });
app.post("/auth/login", authLimiter, async (req, res) => {
  const body = z.object({
    email: z.string().email(),
    password: z.string().min(8),
  }).safeParse(req.body);
  if (!body.success) return res.status(400).json({ error: "Invalid input" });
  // constant-time compare in real auth service
  res.json({ token: "..." });
});
 
type User = { id: string; tenantId: string; role: string };
 
function requireAuth(req: express.Request): User {
  const user = (req as express.Request & { user?: User }).user;
  if (!user) throw new HttpError(401, "Unauthorized");
  return user;
}
 
app.patch("/users/:id", async (req, res) => {
  const actor = requireAuth(req);
  const targetId = z.string().uuid().parse(req.params.id);
  if (actor.id !== targetId && actor.role !== "admin") {
    return res.status(403).json({ error: "Forbidden" });
  }
  const patch = z.object({ name: z.string().min(1).max(120) }).parse(req.body);
  res.json(await usersRepo.update(targetId, patch));
});

// Fastify: JSON Schema at route + preHandler auth
app.get("/orders/:id", {
  schema: { params: { type: "object", properties: { id: { type: "string", format: "uuid" } } } },
  preHandler: [authenticate, authorizeOrderRead],
}, handler);

# Generate OpenAPI and diff on PR
npx @redocly/cli lint openapi.yaml