OWASP API Security Top 10: Practical Vulnerability Analysis and Defensive Code

// GET /api/orders/{orderId}
app.get('/api/orders/:orderId', async (req, res) => {
 // : User check
  const order = await Order.findById(req.params.orderId);
  res.json(order);
});

app.get('/api/orders/:orderId', authenticate, async (req, res) => {
  const order = await Order.findOne({
    _id: req.params.orderId,
 userId: req.user.id // required
  });
  if (!order) return res.status(403).json({ error: 'Forbidden' });
  res.json(order);
});

import jwt from 'jsonwebtoken';

const token = jwt.sign(
  { userId: user.id },
  process.env.JWT_SECRET,
  { algorithm: 'HS256', expiresIn: '1h' }
);

// when when required
const decoded = jwt.verify(token, process.env.JWT_SECRET, {
  algorithms: ['HS256']
});

// :
res.json(user); // password_hash, internal_id

// :
const { id, name, email } = user;
res.json({ id, name, email });

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  message: { error: 'Too many requests' }
});

app.use('/api/', limiter);