Secure REST API in 2026: Best Practices
The 5 pillars of a secure REST API: JWT authentication, rate limiting, CORS, validation, and logging.
API security has become a critical concern. 83% of web attacks now target APIs rather than user interfaces. Here are the 5 pillars of a secure REST API in 2026.
1. JWT Authentication
JSON Web Tokens remains the standard for stateless authentication. The golden rules:
- HS256 algorithm minimum: never use "none" or RS256 without key rotation
- Short expiration: 15 minutes for access tokens, 7 days for refresh tokens
- Minimal claims: only include user ID and roles
const token = jwt.sign(
{ sub: user.id, role: user.role },
process.env.JWT_SECRET,
{ algorithm: 'HS256', expiresIn: '15m' }
);Never store JWT in localStorage. Use an HttpOnly, Secure, SameSite=Strict cookie instead.
2. Rate Limiting
Protect your endpoints against abuse with per-IP and per-user rate limiting:
const rateLimiter = {
windowMs: 15 * 60 * 1000,
max: 100,
standardHeaders: true,
legacyHeaders: false,
};Apply stricter limits on sensitive endpoints: login (5 attempts/15min), account creation (3/hour), password reset (3/hour).
3. Strict CORS
Configure CORS with an explicit allowlist. Never use wildcard (*) in production:
- origin: list of authorized domains only
- methods: limit to necessary methods (GET, POST, PUT, DELETE)
- credentials: true only if using cookies
4. Input Validation
Validate every input with a strict schema. Zod in TypeScript, Pydantic in Python:
const createUserSchema = z.object({
email: z.string().email().max(255),
name: z.string().min(2).max(100),
password: z.string().min(12).max(128),
});- Reject anything not explicitly allowed
- Escape outputs to prevent XSS
- Parameterize SQL queries to prevent injection
5. Logging and Monitoring
Log every request with essential information, without sensitive data:
- Timestamp, method, path, status code, duration
- Source IP (for rate limiting and abuse detection)
- Never: passwords, tokens, personal data
Conclusion
API security is not optional. These 5 pillars — JWT, rate limiting, CORS, validation, logging — form the minimum foundation for any professional API in 2026.