7 Simple Techniques to Protect Your APIs

APIs (Application Programming Interfaces) connect different apps and systems. They are powerful but also risky if not protected. A weak API can expose data, allow attacks, or even break your service. The good news is, you can apply some simple techniques to make your APIs safer. Let’s go through 7 key techniques.

1) Rate Limiting

What it is: Control how many requests a user or IP can make in a time window.
Why it matters: Stops abuse, bots, and noisy clients from overloading your servers.
How to start:

Pick a limit, e.g., 100 requests per minute per IP.
Return 429 Too Many Requests when the limit is hit.
Show helpful headers (remaining requests, reset time).
Use built-in tools (API gateway, Nginx, Cloudflare, Express middleware).

Quick tip: Different limits for different routes. Login and search need tighter limits.

2) CORS (Cross-Origin Resource Sharing)

What it is: Rules that tell browsers which websites can call your API.
Why it matters: Blocks unwanted sites from using your API in the user’s browser.
How to start:

Allow only your domains (e.g., https://app.example.com), not *.
Set allowed methods and headers clearly.
Don’t allow credentials with *. Use an exact origin when credentials: true.

Quick tip: Keep a short, explicit allow-list. Review it regularly.

3) Stop SQL & NoSQL Injection

What it is: Attackers try to inject queries through user input to read or change data.
Why it matters: Can leak or destroy your database.
How to start:

Parameterized queries or prepared statements (never build queries by string concatenation).
Use an ORM with bindings.
Validate and sanitize inputs (type, length, format).
Minimum DB permissions for the app user.

Simple rule: Treat every input as untrusted.

4) Firewalls (Network + WAF)

What it is: Filters for network traffic and HTTP requests.
Why it matters: Blocks bad traffic before it hits your app.
How to start:

Network firewall: Open only needed ports (usually 80/443). Lock down admin ports.
Web Application Firewall (WAF): Blocks common attacks (SQLi, XSS, path traversal).
Turn on DDoS protection if available.
Log and alert on unusual patterns.

Quick tip: Put your API behind a gateway or CDN with a WAF.

5) VPNs (Virtual Private Networks)

What it is: Encrypted tunnels for private access.
Why it matters: Keeps internal or admin APIs hidden from the public internet.
How to start:

Put staging, admin, or partner-only APIs behind a VPN or private network.
Combine with IP allow-lists when possible.
Still use HTTPS—defense in depth.

Use case: Internal microservices that never need public exposure.

6) CSRF (Cross-Site Request Forgery) Protection

What it is: Tricks a logged-in user’s browser to send unwanted requests.
Why it matters: Can change user data without their consent.
How to start:

Use SameSite cookies (Lax or Strict) for session cookies.
Add CSRF tokens to state-changing requests (POST/PUT/PATCH/DELETE).
Prefer Authorization headers (Bearer tokens) over cookies for APIs used by SPAs/native apps.

Quick tip: If you must use cookies, combine SameSite, Secure, and CSRF tokens.

7) XSS (Cross-Site Scripting) Defense

What it is: Injecting malicious scripts into pages used by your users.
Why it matters: Steals tokens, sessions, or user data.
How to start:

Escape/encode any user-generated content you render.
Sanitize rich text inputs on the server.
Set a Content-Security-Policy (CSP) to restrict where scripts can load from.
Avoid innerHTML with raw input on the frontend.

Quick tip: If you must render HTML, use a trusted sanitizer.

Minimal Starter Checklist

HTTPS everywhere. No HTTP.
Auth on every protected route. Use short-lived tokens (JWT or opaque).
Role-based access (least privilege).
Rate limit per IP/user/key.
Strict CORS allow-list.
Parameterized DB queries only.
WAF enabled + logs monitored.
CSRF tokens or SameSite cookies (for browser flows).
Output escaping + CSP for XSS.
Logs + alerts for errors, 401/403/429 spikes, and unusual traffic.