I — Core Concepts
2 articles- 01Why Does Security Matter? Understanding the Real ConsequencesThe real consequences of ignoring API security, the defense-in-depth mindset, and a simple threat-modeling exercise we'll keep practicing throughout this series.
- 02Anatomy of Common Threats: OWASP API Security BasicsThe six most common API threats from the OWASP framework — BOLA, broken authentication, excessive data exposure, injection, security misconfiguration, and unrestricted resource consumption — mapped to the hands-on articles that address them.
II — Hands-On Practice
5 articles- 03Hands-On: Password Hashing & JWT AuthenticationClosing off Broken Authentication with bcrypt password hashing, a register endpoint with an explicit response model, and JSON Web Tokens to prove identity without the server storing sessions.
- 04Hands-On: Authorization, Access Control & Rate LimitingClosing off Broken Object Level Authorization and Unrestricted Resource Consumption — verifying resource ownership on every endpoint, and Redis-backed rate limiting to prevent login brute force.
- 05Hands-On: Preventing Injection & Input ValidationProving SQL injection completely fails against our code thanks to parameterized queries, using Pydantic validation as an active defense layer, and why XSS isn't a direct threat for a JSON API.
- 06Hands-On: Secrets, HTTPS & Security HeadersClosing off Security Misconfiguration — secrets management with a fail-secure principle, why TLS lives at the reverse proxy, locking down CORS, and adding cheap but effective HTTP security headers.
- 07Hands-On: Dependency & Container Security ScanningSupply chain security — scanning dependencies with pip-audit, container hardening with a non-root user, and other good habits for a safer Docker image.