API Security Best Practices

# API Keys
X-API-Key: abc123xyz789

# Bearer Tokens (JWT)
Authorization: Bearer eyJhbGci...

# Basic Auth
Authorization: Basic dXNlcjpwYXNz

# OAuth 2.0
Authorization: Bearer {token}

# Express rate limiter
const rateLimit = require("express-rate-limit");

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 100
});

app.use("/api/", limiter);

# Validate all inputs
const schema = {
    email: /^[^\s@]+@[^\s@]+$/,
    age: (val) => val >= 0 && val <= 120
};

# Sanitize inputs
const clean = input.trim().toLowerCase();

# Essential headers
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000

# Express helmet
const helmet = require("helmet");
app.use(helmet());

# Redirect to HTTPS
app.use((req, res, next) => {
    if (!req.secure) {
        return res.redirect(301, "https://" + req.headers.host + req.url);
    }
    next();
});