Varno oblikovanje API-jev vključuje zaščito API-jev pred zlorabami in napadi — через pravilno avtentikacijo/avtorizacijo, validacijo vhodnih podatkov, omejitev stopnje zahtevkov, HTTPS in previdno ravnanje s podatki. API-ji so pogosti tarče napadov, zato jih je važno zaščititi.
Osnovne prakse varnosti API-jev
✓ AUTHENTICATION → verify who's calling (API keys, OAuth tokens, JWT) — don't leave
endpoints open
✓ AUTHORIZATION → check the caller is allowed for EACH endpoint/resource (per-request,
server-side; prevent accessing others' data — broken access control / IDOR)
✓ HTTPS/TLS → always (encrypt API traffic; never plain HTTP)
✓ INPUT VALIDATION → validate/sanitize all inputs (prevent injection, malformed data)
✓ Don't EXPOSE sensitive data → return only needed fields; no secrets/internal data in responses
