Api Security Hardener

What it does

This skill, Api Security Hardener, helps implement comprehensive security measures for production APIs. It focuses on securing API workflows by providing tools and schemas for input validation, authentication, authorization, rate limiting, setting security headers, and logging & monitoring to detect potential threats. The skill utilizes Zod schema validation for robust data sanitization and offers middleware for validating request bodies, query parameters, and route parameters.

When to use it

• When building new APIs that require strong input validation to prevent vulnerabilities.
• To enhance the security of existing APIs by implementing authentication and authorization controls.
• For protecting APIs from abuse through rate limiting mechanisms.
• When needing to sanitize HTML content within API requests.
• To ensure consistent data formats and enforce business rules via Zod schemas.

Key capabilities

• Input Validation: Uses Zod schema validation for sanitizing and validating input data. Includes pre-built schemas for email, password, UUIDs, pagination, user creation/updates, and sanitized strings.
• Authentication: Enables secure identity verification within API workflows (specific implementation details not provided).
• Authorization: Supports role-based access control to restrict API access (implementation details not provided).
• Rate Limiting: Helps prevent abuse by implementing rate limiting mechanisms (implementation details not provided).
• Security Headers: Allows for setting HTTP headers to enhance security.
• Logging & Monitoring: Facilitates threat detection through logging and monitoring of API activity.
• Validation Middleware: Provides middleware functionality for validating request bodies, query parameters, and route parameters using Zod schemas.

Example prompts

• "Apply the email schema validation to the user creation endpoint."
• "Implement rate limiting on the /products endpoint."
• "Sanitize HTML content from the comment input field."

Tips & gotchas

• Requires familiarity with Zod schema definition and implementation.
• The skill provides schemas and middleware; specific authentication, authorization, and rate-limiting implementations are not included.
• To get the most out of this skill, define clear Zod schemas that accurately represent your API's expected data formats and constraints.