Define an explicit list of permitted origins. Never reflect the incoming Origin header. Reject all origins not on the list.
🤐
MIT 02 — Sanitize Error Messages
Return generic error messages to clients. Log detailed errors internally. Disable debug mode and stack trace exposure in all non-development environments.
📋
MIT 03 — Required Security Headers
Set HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy on all API responses. Each header removes a browser-exploitable attack surface.
🔧
MIT 04 — Disable Unnecessary HTTP Methods
Each endpoint should only accept the HTTP methods it intentionally implements. Return 405 Method Not Allowed for all others. Configure at the routing or middleware layer.
🔒
MIT 05 — Enforce HTTPS and Modern TLS
Serve the API over HTTPS only. Reject HTTP requests or redirect them. Require TLS 1.2+ — disable TLS 1.0 and 1.1. Validate and renew certificates automatically.
🛠️
MIT 06 — Protect or Remove Debug and Admin Endpoints
Remove development-only endpoints before production deployment. Require strong authentication on all admin interfaces. Restrict by IP where possible. Never expose management UIs to the internet without auth.
🤖
MIT 07 — Automated Security Configuration Scanning
Integrate configuration validation into CI/CD. Tools like OWASP ZAP, Mozilla Observatory, or custom scripts can verify headers, CORS, TLS, and endpoint exposure automatically on every deployment.