Harden API configuration

Security misconfiguration can expose a sound codebase. Production deserves its own review, because the most dangerous defaults are development conveniences nobody remembered to turn off.

Inventory every layer

Inventory gateway, proxy, runtime, framework, storage, and cloud settings. Remove default accounts and sample routes. Keep diagnostics and internal schemas behind the access policy their content requires.

Default accounts and sample routes deserve a dedicated pass. They ship enabled, they are documented publicly, and scanners probe for them by name within hours of a deployment going live.

Development may expose stack traces, wildcard CORS, and interactive API docs. Copying those defaults into production can bypass careful application code: the stack trace names your framework and file paths, permissive CORS lets hostile pages read API responses, and a public Swagger UI hands over a complete map of the attack surface.

Probe the effective behavior

Inspect effective runtime behavior because environment variables, gateway rules, and framework defaults may override reviewed files:

# does production answer methods you never use?
curl -i -X TRACE https://api.example.com/invoices
# want: HTTP/1.1 405 Method Not Allowed

# does CORS reflect arbitrary origins?
curl -i -X OPTIONS https://api.example.com/invoices \
  -H "Origin: https://evil.example" \
  -H "Access-Control-Request-Method: GET"
# want: no Access-Control-Allow-Origin header for unknown origins

# are the interactive docs public?
curl -i https://api.example.com/docs
# want: 401 or 404 in production, or a deliberate decision otherwise

A middleware that reflects any Origin value back into Access-Control-Allow-Origin is wildcard CORS wearing a disguise. It passes a casual config review and fails this probe.

Check the downstream path too

Verify TLS across downstream connections too. The gateway terminating HTTPS means little if the hop to the application or database crosses a shared network in plaintext:

psql "host=db.internal dbname=invoices sslmode=require" -c "SHOW ssl;"
#  ssl
# -----
#  on

Save response headers and probe results beside the intended configuration after every production deployment. Configuration drifts quietly; the probes catch what review misses.

Capture effective production settings from the gateway and application, not only configuration files. Probe an unused method, foreign origin, debug route, and downstream plaintext connection, then record the denied result.