Module 10 Activity

Scenario

Put a security boundary around the service that is honest about what it protects.

What you build

Key-based authentication with per-action authorisation, credentials in headers, and rate limiting with shared state.

Steps

1. Write down what your API key does and does not prove.
2. Audit every credential path and move anything in a query string or URL to a header.
3. Separate authentication from authorisation: resolve the caller, then check the scope, returning 401 and 403 appropriately.
4. Configure CORS for the origins that need it, and write down what it does not protect.
5. Implement rate limiting with a shared store rather than in-process state, and return Retry-After with every 429.
6. Test the limiter with the worker count you deploy with.

Evidence to hand in

• What the key proves, in writing.
• The credential audit with any moves.
• The 401 and 403 paths.
• The CORS configuration and its stated limits.
• The rate limiter with shared state and Retry-After.
• The multi-worker test.

Review checklist

• What the key proves is written down, and it is only one thing.
• No credential travels in a query string or URL path.
• Authentication and authorisation are separate checks returning 401 and 403.
• What CORS does not protect is stated.
• The rate limiter uses shared state and returns Retry-After.

Mark complete