Secure REST APIs

Introduction

Securing a REST API is more than authentication. The OWASP API Top 10 covers the real risks; Spring Boot makes most defences a checkbox.

Understanding the topic

The non-negotiables:

• HTTPS only (HSTS), TLS 1.2+.
• Authentication on every endpoint except /health and login.
• Authorization per resource — never trust client-supplied userId.
• Validation on every input — @Valid + size limits.
• Rate limiting (Bucket4j or gateway) to prevent brute-force/DDoS.
• Audit logs — who did what when, with trace IDs.
• Security headers — CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.