api-security-hardening

@aj-geddes · 收录于 5 天前 · 上游提交 4 个月前

Secure REST APIs with authentication, rate limiting, CORS, input validation, and security middleware. Use when building or hardening API endpoints against common attacks.

场景接口上线前安全审计

适合你，如果正在构建或加固对外暴露的 API 端点

/ 下载安装

https://github.com/aj-geddes/useful-ai-prompts/tree/main/skills/api-security-hardening ↗

/ 通过 npx 安装 校验哈希

npx oh-my-skill add aj-geddes/useful-ai-prompts/api-security-hardening

/ 通过 bash 安装

curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- aj-geddes/useful-ai-prompts/api-security-hardening

/ 已经装过?验证本机副本,不用重装

npx oh-my-skill verify aj-geddes/useful-ai-prompts/api-security-hardening

安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。

300GitHub stars

~431最小装载

~3.3K含声明引用

~3.4K文本包总量

索引托管

怎么用

商店整理自技能原文 · 版本 3f5182c · 表述以原文为准

它做什么

装上后，Claude能帮你给API添加认证、速率限制、CORS设置、输入验证等安全防护，防止常见网络攻击。

什么时候触发

当你开发新API或加固现有API时触发。例如：你想给API加登录验证或防止频繁请求。

装好后可以这样说

Claude会生成相关代码并解释配置。

Claude会提供实现步骤和示例代码。

Claude会分析并给出改进建议。

技能原文 SKILL.md作者撰写 · MIT · 3f5182c

API Security Hardening

[Overview](#overview)
[When to Use](#when-to-use)
[Quick Start](#quick-start)
[Reference Guides](#reference-guides)
[Best Practices](#best-practices)

Overview

Implement comprehensive API security measures including authentication, authorization, rate limiting, input validation, and attack prevention to protect against common vulnerabilities.

When to Use

New API development
Security audit remediation
Production API hardening
Compliance requirements
High-traffic API protection
Public API exposure

Quick Start

Minimal working example:

// secure-api.js - Comprehensive API security
const express = require("express");
const helmet = require("helmet");
const rateLimit = require("express-rate-limit");
const mongoSanitize = require("express-mongo-sanitize");
const xss = require("xss-clean");
const hpp = require("hpp");
const cors = require("cors");
const jwt = require("jsonwebtoken");
const validator = require("validator");

class SecureAPIServer {
  constructor() {
    this.app = express();
    this.setupSecurityMiddleware();
    this.setupRoutes();
  }

  setupSecurityMiddleware() {
    // 1. Helmet - Set security headers
    this.app.use(
      helmet({
        contentSecurityPolicy: {
          directives: {
            defaultSrc: ["'self'"],
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

| Guide | Contents | |---|---| | [Node.js/Express API Security](references/nodejsexpress-api-security.md) | Node.js/Express API Security | | [Python FastAPI Security](references/python-fastapi-security.md) | Python FastAPI Security | | [API Gateway Security Configuration](references/api-gateway-security-configuration.md) | API Gateway Security Configuration |

Best Practices

✅ DO

Use HTTPS everywhere
Implement rate limiting
Validate all inputs
Use security headers
Log security events
Implement CORS properly
Use strong authentication
Version your APIs

❌ DON'T

Expose stack traces
Return detailed errors
Trust user input
Use HTTP for APIs
Skip input validation
Ignore rate limiting

按 MIT 许可原样转载,未经改动 · 在 GitHub 查看 →

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。

…