api-securitylisted

# API Security — OWASP API Security Top 10 (2023) for Next.js Production-grade API security patterns for Next.js App Router. Covers every category in the OWASP API Security Top 10 (2023) with cross-references to the OWASP Web Top 10 (2021). Verified against the official OWASP specifications. ## Architecture ``` Request → proxy.ts (auth gate) → Route Handler / Server Action ↓ Input Validation (Zod) ↓ Data Access Layer (auth + authz + DTO) ↓ Database (parameterized queries) ↓ Filtered Response (DTO, no raw records) ``` The **Data Access Layer (DAL)** is the central security architecture recommended by Next.js. All database access, authorization checks, and response filtering happen in one `server-only` module — never in components or actions directly. ## Quick Reference | Resource | OWASP API | OWASP Web | What It Covers | |----------|-----------|-----------|----------------| | [Access Control](resources/access-control.md) | API1, API5 | A01 | BOLA/IDOR, function-level auth, ownership checks | | [Authentication](resources/authentication.md) | API2 | A07, A02 | Session management, JWT, Clerk/Auth0, proxy.ts | | [Input Validation](resources/input-validation.md) | API3, API8 | A03 | Zod s