Platform Engineering
Commerce API Security Lab
A defensive commerce API: rate limiting, JWT, RBAC, ownership checks and audit logging, mapped to OWASP.
The Problem
Commerce APIs expose carts, orders and admin functions. Most real breaches are authorisation mistakes, not exotic exploits.
How It Works
- Rate-limit per IP with a token bucket (5/min on login, 100/min elsewhere).
- Validate HS256 JWTs; an invalid token is simply unauthenticated so authorisation returns the correct 401.
- Enforce roles centrally, then resolve ownership from the token subject — never from the request — and audit security events.
Technically Interesting
Object-level authorisation (BOLA) is solved in the service layer and proved by an integration test that a customer cannot read another customer’s order.
Why It Matters
Security is an architecture concern: each OWASP risk gets a specific control at a specific layer.
Scope & honesty. A reference lab with in-memory users and audit buffer — a walkthrough of the design, not a deployed service.