System Security / 2026 Essentials
Secure the API, Not Just the Website in Front of It
Each endpoint needs appropriate authentication, authorisation, and input controls.
Environment and inputs: A staging API, a low-privilege test account, synthetic records and the expected access decision for each operation.
A business API may be called directly by scripts, mobile clients, and AI tools. The web interface cannot enforce its security on its own. OWASP’s REST guidance calls for HTTPS and access controls at non-public endpoints, with careful validation of tokens and incoming data.
What matters
- Verify the caller and its permission for the requested resource and operation.
- Validate token signatures and relevant claims rather than accepting a token because it is present.
- Limit request sizes and rates and return errors that do not expose internal details.
Practical example: An inventory API lets a reporting account read stock levels but rejects attempts to change quantities.
One action today: Review one API endpoint using a low-privilege account and malformed input.