Sigurno dizajniranje API-ja uključuje zaštitu API-ja od zlouporabe i napada — kroz odgovarajuću autentifikaciju/autorizaciju, validaciju unosa, ograničenje brzine, HTTPS i pažljivo rukovanje podacima. API-ji su česti cilj napada, pa je njihovo osiguranje važno.
Temeljne prakse sigurnosti API-ja
✓ AUTHENTICATION → verify who's calling (API keys, OAuth tokens, JWT) — don't leave
endpoints open
✓ AUTHORIZATION → check the caller is allowed for EACH endpoint/resource (per-request,
server-side; prevent accessing others' data — broken access control / IDOR)
✓ HTTPS/TLS → always (encrypt API traffic; never plain HTTP)
✓ INPUT VALIDATION → validate/sanitize all inputs (prevent injection, malformed data)
✓ Don't EXPOSE sensitive data → return only needed fields; no secrets/internal data in responses
