Praktik Apik Keamanan API

Keamanan kudu dadi prioritas ing saben API. Iki sawetara cara penting kanggo nglindhungi endpoint.

Autentikasi

Praktik Apik JWT

Tandhatangani token kanthi wektu kadaluwarsa lan priksa wektune nalika token dienggo:

// Sign token with expiration
const token = jwt.sign(
  { userId: user.id },
  process.env.JWT_SECRET!,
  { expiresIn: '1h' }
);

// Verify with expiration check
const decoded = jwt.verify(token, process.env.JWT_SECRET!);

OAuth 2.0

Kanggo integrasi karo pihak katelu, gunakake OAuth 2.0.

Otorisasi

Kontrol Akses Miturut Peran (RBAC)

Watesi operasi miturut peran pangguna. Tuladha iki nolak panjaluk yen perane ora diidini:

function authorize(roles: string[]) {
  return (req: Request, res: Response, next: NextFunction) => {
    if (!roles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    next();
  };
}

// Usage
router.delete('/users/:id', authorize(['admin']), deleteUser);

Validasi Input

Tansah priksa lan resiki input:

const schema = z.object({
  email: z.string().email(),
  password: z.string().min(8)
});

function validateInput(data: unknown) {
  return schema.parse(data);
}

Watesan Panjaluk

Kanggo nyegah penyalahgunaan, watesi jumlah panjaluk:

app.use('/api', rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
}));

Header Keamanan

Gunakake helmet.js kanggo nambah header keamanan:

app.use(helmet());

Kesimpulan

Keamanan kudu terus digatekake. Tansah ngerteni celah keamanan anyar lan pasang patch sing dibutuhake.