API & Security Highlights Summary

Every highlight bullet from the 11 pages in this section, gathered on one page and grouped by the page it came from.

The Python API Trust Boundary

• A trust boundary is any point where data or control crosses from outside your process into code that treats it as trusted
• A Python API has at least five distinct trust boundaries, not just 'the endpoint'
• Pydantic validation, authentication, and authorization each guard a different boundary and none substitutes for the others
• Fail-closed is a design default: an error or ambiguous check result should deny, never silently allow

API Design Basics

• Use nouns in URL paths and verbs in HTTP methods for RESTful resource URLs
• Return 201 Created for POST success, 204 No Content for DELETE, 409 for conflicts
• Provide machine-readable error responses with code, message, and optional field keys
• Version APIs with URL prefix like /v1/users for clarity and deprecation control
• Use Idempotency-Key header for safe POST retries and payment transactions
• Implement cursor-based pagination for large datasets over offset patterns

GraphQL in Python

• Use Strawberry decorators to define strongly typed GraphQL schemas in Python
• GraphQL resolves only the requested fields from each client query
• Guard GraphQL resolvers against depth and complexity attacks
• Strawberry Schema combines type hints with GraphQL schema creation
• Use GraphQL for BFF aggregation with flexible client-driven queries
• Authenticate at the transport layer, not at individual field level

OAuth2 & JWT

• OAuth2 defines flows while JWT is the token format
• Validate iss aud and exp claims on every request
• Use asymmetric keys like RS256 for production scale
• Use jwt.encode and jwt.decode from python-jose
• Ideal for SPA mobile and service-to-service auth flows
• Always validate tokens with an algorithm allow list

Password & Credential Handling

• Hash passwords with argon2, never store plaintext credentials
• Use ph.verify() to check passwords, never string comparison
• Tune argon2 memory and time cost to balance security and speed
• Rate-limit login attempts to prevent brute force attacks
• Argon2 automatically generates unique salt per password
• Apply argon2 hashing to registration and password reset flows

Secrets Management

• Load secrets from environment or mounted files, never hardcode in application code
• Use os.environ[KEY] pattern to access database URLs, API keys, and signing keys
• Mount Kubernetes secrets to file paths, read at runtime with Path().read_text()
• Rotate secrets without code redeploy by storing configuration externally
• Scan git history for leaked credentials if secrets are accidentally committed

Input Validation & Injection

• Use bound parameters in SQL to prevent injection attacks
• Replace os.system with subprocess.run using list arguments, never f-strings
• Validate type, length, and format for all external input at the boundary
• Treat file paths as untrusted and sanitize before passing to shell commands
• Apply parameterization to SQL queries and escape template rendering contexts
• Use ORM parameterization when constructing database queries and commands

cryptography Essentials

• Use Fernet for symmetric encryption instead of custom crypto implementations
• Generate encryption keys with Fernet.generate_key() securely
• Store keys in HSM or secrets vault, never hardcode credentials
• Rotate keys using dual-read windows to maintain availability
• Fernet combines encryption and authentication in one operation
• Protect cookies and sign webhooks using Fernet symmetric keys

Rate Limiting & Abuse Prevention

• Use slowapi and redis for token bucket rate limits
• Throttle endpoints with 100 requests per minute limit
• Layer rate limits at edge and application tiers
• Return HTTP 429 with Retry-After header for limits
• Apply stricter rate limits on login and password reset
• Implement per-IP and per-token limits for bot defense

Dependency & Supply-Chain Security

• Use pip-audit to detect known vulnerabilities in Python dependencies
• Pin transitive dependencies in lockfiles to control package versions
• Generate SBOMs with cyclonedx for supply chain compliance tracking
• Monitor CVE advisories and rebuild production images on security patches
• Compile requirements with uv to create lockfiles and reproducible builds

API & Security Best Practices

• Enforce HTTPS everywhere and set HSTS headers for browser clients
• Use short-lived tokens with refresh rotation for authentication
• Hash passwords with argon2 or bcrypt, not plaintext
• Parameterize SQL queries and validate all input at service boundary
• Run pip-audit or uv audit in CI to catch dependency vulnerabilities
• Store secrets in vaults, never commit credentials to version control