Week 11 Mini Project: API Security Gateway

Complete Security Layer Stack

Incoming Request
    │
    ├── CORS Preflight? → Return 204 with CORS headers
    │
    ├── Rate Limit by IP (before auth — DDoS protection)
    │
    ├── Authentication: API Key OR HMAC OR ECDSA Token
    │   └── Failure → 401 (constant time)
    │
    ├── Rate Limit by authenticated user (post-auth quotas)
    │
    ├── Abuse Detection: credential stuffing, honeypot check
    │
    ├── WAF (from Week 10)
    │
    ├── JSON Schema Validation (per route)
    │
    ├── Input Validation (struct tags)
    │
    ├── PII Scrubber (mask sensitive fields in logs)
    │
    ├── Security Headers (HSTS, CSP, X-Frame-Options)
    │
    └── Application Handler

Full Middleware Chain

// gateway/api_security.go
func BuildAPIGateway(cfg *GatewayConfig) http.Handler {
    // Auth backends
    apiKeyStore := &MemAPIKeyStore{keys: cfg.APIKeys}
    tokenService, _ := NewTokenService()

    // Rate limiters
    ipLimiter := NewRateLimiter(50, 10)   // 50 burst, 10/s per IP
    userLimiter := NewRateLimiter(200, 50) // 200 burst, 50/s per user

    // WAF
    waf := NewScoringWAF(DefaultRules(), "waf-config.json", NewAuditLogger())

    // CORS
    cors := New(cfg.CORSConfig)

    // Abuse detector
    abuse := &AbuseDetector{}

    appHandler := buildRoutes()

    return Chain(appHandler,
        PanicRecoverer(slog.Default()),
        RequestID,
        cors.Middleware,
        ipLimiter.Middleware(func(r *http.Request) string { return "ip:"+realClientIP(r) }),
        ECDSATokenAuth(tokenService), // or APIKeyAuth(apiKeyStore)
        userLimiter.Middleware(func(r *http.Request) string { return "user:"+GetSubject(r.Context()) }),
        waf.Handler,
        PIIProtectionMiddleware(false),
        SecurityHeadersMiddleware(cfg.SecurityHeaders),
        RequestLogger(slog.Default()),
    )
}

Engineer Takeaway

This is the security policy of your API platform codified in software. Every middleware maps to a specific OWASP category or compliance control. You can now review a pull request or design doc for an API service and say whether each layer is implemented correctly, and which attack it prevents.