Building secure REST APIs: authentication, validation, and rate limiting

API security starts with strong authentication. Use JWT tokens with short expiry times (15 minutes) and refresh tokens for longer sessions. Store refresh tokens securely in HTTP-only cookies on the server.

Validate all inputs strictly. Reject requests that don't match your schema, use TypeScript to catch type errors at compile time, and validate request bodies before processing. This prevents injection attacks and malformed data from crashing your service.

Implement rate limiting per user and per IP. Use libraries like express-rate-limit to prevent brute force attacks and denial-of-service attempts. Combine with monitoring to alert on suspicious patterns.

Use CORS correctly: set explicit allowed origins, restrict HTTP methods to what's needed, and validate the Origin header. Never use Access-Control-Allow-Origin: * with credentials.