API Route Security

Authentication

Always verify user authentication before processing requests:

typescript

import { getServerSession } from 'next-auth';
import { authOptions } from '@/lib/auth';

export async function POST(request: Request) {
  const session = await getServerSession(authOptions);
  
  if (!session) {
    return Response.json(
      { error: 'Unauthorized' },
      { status: 401 }
    );
  }
  
  // Process request...
}

Input Validation

Always validate and sanitize user input
Use Zod or similar validation libraries
Implement rate limiting
Prevent SQL injection with parameterized queries

CORS Configuration

Configure CORS headers appropriately for your API routes.

Security Headers

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

API Route Security

Authentication

Always verify user authentication before processing requests:

typescript

import { getServerSession } from 'next-auth';
import { authOptions } from '@/lib/auth';

export async function POST(request: Request) {
  const session = await getServerSession(authOptions);
  
  if (!session) {
    return Response.json(
      { error: 'Unauthorized' },
      { status: 401 }
    );
  }
  
  // Process request...
}

Input Validation

Always validate and sanitize user input
Use Zod or similar validation libraries
Implement rate limiting
Prevent SQL injection with parameterized queries

CORS Configuration

Configure CORS headers appropriately for your API routes.

Security Headers

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

API Route Security

API Route Security

Authentication

Input Validation

CORS Configuration

Security Headers

Tags

Related Instructions

TypeScript Error Handling

React Component Best Practices

WordPress Development — Copilot Instructions

VueJS 3 Development Instructions

TypeScript MCP Server Development

TypeScript Development

API Route Security

Authentication

Input Validation

CORS Configuration

Security Headers