Last month I audited 15 REST APIs from companies ranging from seed-stage startups to Series C. Every single one was missing at least 3 critical security headers. Most were missing 5 or more. These aren’t obscure hardening techniques — they’re baseline security that takes 10 minutes to implement.
<h2>1. Content-Type validation (the silent killer)</h2>
Most APIs accept any Content-Type header — or worse, ignore it entirely. An attacker can send:
<pre><code>POST /api/users
Content-Type: text/html

&lt;script&gt;alert(&#x27;xss&#x27;)&lt;/script&gt;
</code></pre>
If your API stores this and any endpoint reflects it without escaping, you have stored XSS.
Fix: Validate Content-Type on every endpoint. Reject anything that isn’t what you expect.
<pre><code class="language-javascript">app.use((req, res, next) =&gt; {
 if ([&#x27;POST&#x27;, &#x27;PUT&#x27;, &#x27;PATCH&#x27;].includes(req.method)) {
 if (!req.is(&#x27;application/json&#x27;)) {
 return res.status(415).json({ error: &#x27;Unsupported Media Type&#x27; });
 }
 }
 next();
});
</code></pre>
<h2>2. Rate limiting headers</h2>
Not having rate limiting is a security vulnerability. But even with rate limiting, you should tell clients about it:
<pre><code>X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 1709728800
Retry-After: 30
</code></pre>
Without these headers, legitimate clients can’t back off gracefully, and you can’t distinguish between bugs and attacks.
<h2>3. Security response headers</h2>
These should be on every response from your API:
<pre><code class="language-javascript">// Prevent clickjacking
res.setHeader(&#x27;X-Frame-Options&#x27;, &#x27;DENY&#x27;);

// Prevent MIME type sniffing
res.setHeader(&#x27;X-Content-Type-Options&#x27;, &#x27;nosniff&#x27;);

// Control referrer information
res.setHeader(&#x27;Referrer-Policy&#x27;, &#x27;strict-origin-when-cross-origin&#x27;);

// Permissions policy
res.setHeader(&#x27;Permissions-Policy&#x27;, &#x27;camera=(), microphone=(), geolocation=()&#x27;);
</code></pre>
<h2>4. CORS that isn’t a wildcard</h2>
I cannot count how many APIs I’ve seen with:
<pre><code>Access-Control-Allow-Origin: *
</code></pre>
This means any website on the internet can make authenticated requests to your API if the user is logged in. Use an explicit allowlist.
<h2>5. Cache-Control for sensitive data</h2>
API responses containing user data, tokens, or PII should never be cached by intermediaries:
<pre><code>Cache-Control: no-store, no-cache, must-revalidate, private
Pragma: no-cache
</code></pre>
Without this, proxies and CDNs might cache responses containing user-specific data and serve them to other users. I’ve seen this cause data leaks at two different companies.
<h2>6. Request ID for audit trails</h2>
Every request should get a unique ID that’s returned in the response and logged server-side:
<pre><code>X-Request-ID: 550e8400-e29b-41d4-a716-446655440000
</code></pre>
When something goes wrong, this ID connects the user’s report to your server logs instantly. Without it, correlating “I got an error” to the actual server-side failure is a guessing game.
<h2>7. Strict Transport Security</h2>
If your API is HTTPS (and it should be), tell browsers to never use HTTP:
<pre><code>Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
</code></pre>
This prevents SSL stripping attacks where an attacker downgrades a user’s connection to HTTP and intercepts the traffic.
<h2>The 10-minute implementation</h2>
Create one middleware function. Add all 7 protections. Apply it globally. Done.
<pre><code class="language-javascript">function securityHeaders(req, res, next) {
 res.setHeader(&#x27;X-Content-Type-Options&#x27;, &#x27;nosniff&#x27;);
 res.setHeader(&#x27;X-Frame-Options&#x27;, &#x27;DENY&#x27;);
 res.setHeader(&#x27;Referrer-Policy&#x27;, &#x27;strict-origin-when-cross-origin&#x27;);
 res.setHeader(&#x27;Permissions-Policy&#x27;, &#x27;camera=(), microphone=(), geolocation=()&#x27;);
 res.setHeader(&#x27;Strict-Transport-Security&#x27;, &#x27;max-age=31536000; includeSubDomains&#x27;);
 res.setHeader(&#x27;Cache-Control&#x27;, &#x27;no-store, private&#x27;);
 res.setHeader(&#x27;X-Request-ID&#x27;, crypto.randomUUID());
 next();
}

app.use(securityHeaders);
</code></pre>
10 minutes. Copy-paste. No excuses.
Which of these is your API missing? Be honest — I won’t judge.

sirajju

Your REST API Is Probably Leaking Data — 7 Security Headers You're Missing

The CORS wildcard one always gets me. I’ve seen production APIs serving financial data with Access-Control-Allow-Origin: * because “it fixed the CORS error during development” and nobody changed it. Ten minutes of config prevents a category of vulnerability.