API Security Best Practices for Indian SaaS Products: A Developer's Handbook

API Security Is Not Optional in 2026

With India's Digital Personal Data Protection Act (DPDP Act 2023) now fully enforceable, API security isn't just a technical concern — it's a legal requirement. Breaches can result in penalties up to ₹250 crore. Here are the security patterns every Indian SaaS developer should implement.

1. Authentication: JWT Done Right

Most JWT implementations we audit have critical flaws. Here's the secure implementation pattern:

• Use short-lived access tokens (15 minutes) and long-lived refresh tokens (7 days)
• Store refresh tokens in httpOnly, Secure, SameSite cookies — never in localStorage
• Implement token rotation: issue a new refresh token with every access token refresh
• Maintain a token blacklist in Redis for immediate revocation
• Use RS256 (asymmetric) signing for microservices, HS256 for monoliths

2. Rate Limiting: Beyond Basic Throttling

Implement multi-layered rate limiting:

• Global: 1000 requests/minute per IP
• Per-user: 100 requests/minute per authenticated user
• Per-endpoint: Login attempts limited to 5/minute, password reset to 3/hour
• Sliding window algorithm prevents burst attacks at window boundaries

3. Input Validation: Trust Nothing

Every API endpoint should validate:

• Request body against a JSON schema (use Joi or Zod)
• Query parameters for type, length, and allowed values
• File uploads for type (by magic bytes, not extension), size, and content
• Sanitize HTML input with libraries like DOMPurify or sanitize-html

4. OWASP API Top 10 Prevention

Broken Object Level Authorization (BOLA)

The #1 API vulnerability. Always verify that the authenticated user has permission to access the specific resource they're requesting. Never rely on obscure IDs for security.

Broken Authentication

Implement account lockout after 5 failed attempts. Use bcrypt with cost factor 12 for password hashing. Enforce minimum password complexity requirements.

Excessive Data Exposure

Never return entire database objects. Use response serialization to explicitly define which fields are returned for each endpoint. Different roles should receive different response shapes.

5. DPDP Act Compliance Checklist for APIs

• Implement data access logging (who accessed what, when)
• Provide data export endpoint (right to access)
• Provide data deletion endpoint (right to erasure)
• Encrypt PII at rest and in transit
• Implement consent management for data processing
• Document data retention policies and enforce them programmatically

6. Security Headers for APIs

Configure these headers on every API response:

• Strict-Transport-Security: max-age=31536000; includeSubDomains
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Cache-Control: no-store (for sensitive data endpoints)

Security Audit Service

Webneco offers comprehensive API security audits for Indian SaaS products. We test against OWASP Top 10, verify DPDP Act compliance, and provide a detailed remediation report. Contact us to schedule your audit.