API Security

// npm i jose
import { jwtVerify, createLocalJWKSet } from 'jose'

const JWKS_URL = 'https://issuer.example.com/.well-known/jwks.json'
const ISSUER = 'https://issuer.example.com/'
const AUD = 'orders-api'

// cache JWKS
const jwks = createLocalJWKSet(await (await fetch(JWKS_URL)).json())

export async function verifyAccessToken(bearer) {
  if (!bearer?.startsWith('Bearer ')) throw new Error('Missing bearer')
  const token = bearer.slice(7)
  const { payload } = await jwtVerify(token, jwks, {
    issuer: ISSUER,
    audience: AUD,
    algorithms: ['RS256']
  })
  // Optional: check custom claims (scp/roles)
  if (!payload.scp?.includes('orders:read')) throw new Error('Insufficient scope')
  return payload
}

Key points: use JWKS and kid to pick the right key, enforce issuer/audience, and verify scopes.

// Pseudocode for rotation logic
function rotateRefreshToken(oldTokenId, userId) {
  const old = db.refresh_tokens.findById(oldTokenId)
  if (!old || old.revoked) throw new Error('Invalid refresh token')
  if (old.user_id !== userId) throw new Error('Subject mismatch')

  // Revoke old and create new atomically
  db.transaction(() => {
    db.refresh_tokens.revoke(oldTokenId)
    const newTokenId = uuid()
    db.refresh_tokens.insert({ id: newTokenId, user_id: userId, expires_at: now()+30d })
    return signRefreshToken(newTokenId, userId)
  })
}

Rule: if a used refresh token was already rotated, revoke the entire family to stop token replay.

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel, constr, conint

app = FastAPI()

class CreateOrder(BaseModel):
    sku: constr(strip_whitespace=True, min_length=3, max_length=64)
    qty: conint(gt=0, le=1000)
    note: constr(max_length=500) | None = None

@app.post('/orders')
async def create_order(body: CreateOrder):
    # body is validated and sanitized (e.g., stripped strings)
    return { 'ok': True }

Validate every request object, not just the outer payload.

import hmac, hashlib, base64

SECRET = b'whsec_abc123'

def verify(signature_header: str, body_bytes: bytes) -> bool:
    # signature_header like: "t=1700000000,v1=base64sig"
    items = dict(kv.split('=') for kv in signature_header.split(','))
    timestamp = items['t']
    supplied = base64.b64decode(items['v1'])

    data = f"{timestamp}.".encode() + body_bytes
    computed = hmac.new(SECRET, data, hashlib.sha256).digest()

    return hmac.compare_digest(computed, supplied)

Always use constant-time comparison and include timestamp to limit replay.

server {
  listen 443 ssl http2;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE+AESGCM:ECDHE+CHACHA20';
  ssl_prefer_server_ciphers on;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

Disable TLS 1.0/1.1, prefer modern ciphers, and add HSTS.

• Accepting any signed JWT without checking issuer/audience.
• Long-lived tokens with no rotation or revocation plan.
• Trusting client-provided roles or user IDs without server-side lookup.
• Returning verbose auth errors that leak details (e.g., which claim failed).
• Missing input validation on nested objects and arrays.
• Skipping signature verification for webhooks or using insecure comparison.
• Allowing HTTP or old TLS versions in production.

• Log token kid, issuer, audience, and high-level reason for denial; never log full tokens or secrets.
• Compare working vs failing tokens by decoded header/payload (without sensitive claims).
• Check system clock skew for exp/nbf issues; allow a small leeway if needed.
• For HMAC, confirm exact message bytes and ordering; mismatched encodings cause false failures.
• Use structured logs with request IDs and principal IDs for traceability.

• Auth: Authorization Code + PKCE via an OIDC provider; verify iss/aud/exp/nbf.
• Authorization: roles claim (user, admin). Users can read their own orders; admins can read any.
• Validation: enforce schema for create/update; reject unknown fields.
• Transport: HTTPS only, TLS 1.2+; HSTS on.
• Webhook: POST /webhooks/inventory with HMAC signature and 5-minute replay window.
• Operations: rotate signing key in dev; ensure old webhooks fail after rotation.

• Access token with missing scope is denied with 403 (generic message).
• Admin role can fetch any order; user role gets 403 for others' orders.
• Invalid field in payload triggers 400 with machine-readable error.
• Webhook with altered body or timestamp outside window is rejected.