<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/your-rest-api-is-probably-leaking-data-7-security-headers-you-re-missing-ksvxum6ad" -->

---
title: Your REST API Is Probably Leaking Data — 7 Security...
description: Discussion about &quot;Your REST API Is Probably Leaking Data — 7 Security Headers You&#x27;re Missing&quot; on daily.dev - join the developer community
canonical: https://daily.dev/posts/your-rest-api-is-probably-leaking-data-7-security-headers-you-re-missing-ksvxum6ad
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Your REST API Is Probably Leaking Data — 7 Security Headers You&#x27;re Missing | daily.dev
og:description: Discussion about &quot;Your REST API Is Probably Leaking Data — 7 Security Headers You&#x27;re Missing&quot; on daily.dev - join the developer community
og:url: https://daily.dev/posts/your-rest-api-is-probably-leaking-data-7-security-headers-you-re-missing-ksvxum6ad
og:image: https://api.daily.dev/og/posts/kSvxUm6Ad.png
og:image:alt: Your REST API Is Probably Leaking Data — 7 Security Headers You&#x27;re Missing
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Your REST API Is Probably Leaking Data — 7 Security Headers You're Missing

**[sirajju](https://daily.dev/sources/giqfobcn9hyxcvrvo3s95)** · [@sirajju](https://daily.dev/sirajju) · 1 upvotes · 1 comments

## Content

Last month I audited 15 REST APIs from companies ranging from seed-stage startups to Series C. Every single one was missing at least 3 critical security headers. Most were missing 5 or more. These aren't obscure hardening techniques — they're baseline security that takes 10 minutes to implement.

## 1. Content-Type validation (the silent killer)

Most APIs accept any Content-Type header — or worse, ignore it entirely. An attacker can send:

```
POST /api/users
Content-Type: text/html

<script>alert('xss')</script>
```

If your API stores this and any endpoint reflects it without escaping, you have stored XSS.

**Fix:** Validate Content-Type on every endpoint. Reject anything that isn't what you expect.

```javascript
app.use((req, res, next) => {
  if (['POST', 'PUT', 'PATCH'].includes(req.method)) {
    if (!req.is('application/json')) {
      return res.status(415).json({ error: 'Unsupported Media Type' });
    }
  }
  next();
});
```

## 2. Rate limiting headers

Not having rate limiting is a security vulnerability. But even with rate limiting, you should tell clients about it:

```
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 1709728800
Retry-After: 30
```

Without these headers, legitimate clients can't back off gracefully, and you can't distinguish between bugs and attacks.

## 3. Security response headers

These should be on every response from your API:

```javascript
// Prevent clickjacking
res.setHeader('X-Frame-Options', 'DENY');

// Prevent MIME type sniffing
res.setHeader('X-Content-Type-Options', 'nosniff');

// Control referrer information
res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');

// Permissions policy
res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
```

## 4. CORS that isn't a wildcard

I cannot count how many APIs I've seen with:

```
Access-Control-Allow-Origin: *
```

This means any website on the internet can make authenticated requests to your API if the user is logged in. Use an explicit allowlist.

## 5. Cache-Control for sensitive data

API responses containing user data, tokens, or PII should never be cached by intermediaries:

```
Cache-Control: no-store, no-cache, must-revalidate, private
Pragma: no-cache
```

Without this, proxies and CDNs might cache responses containing user-specific data and serve them to other users. I've seen this cause data leaks at two different companies.

## 6. Request ID for audit trails

Every request should get a unique ID that's returned in the response and logged server-side:

```
X-Request-ID: 550e8400-e29b-41d4-a716-446655440000
```

When something goes wrong, this ID connects the user's report to your server logs instantly. Without it, correlating "I got an error" to the actual server-side failure is a guessing game.

## 7. Strict Transport Security

If your API is HTTPS (and it should be), tell browsers to never use HTTP:

```
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```

This prevents SSL stripping attacks where an attacker downgrades a user's connection to HTTP and intercepts the traffic.

## The 10-minute implementation

Create one middleware function. Add all 7 protections. Apply it globally. Done.

```javascript
function securityHeaders(req, res, next) {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  res.setHeader('Cache-Control', 'no-store, private');
  res.setHeader('X-Request-ID', crypto.randomUUID());
  next();
}

app.use(securityHeaders);
```

10 minutes. Copy-paste. No excuses.

Which of these is your API missing? Be honest — I won't judge.

## Community discussion

Top comments from developers on daily.dev.

**@sirajju** · 0 upvotes

> The CORS wildcard one always gets me. I've seen production APIs serving financial data with Access-Control-Allow-Origin: * because "it fixed the CORS error during development" and nobody changed it. Ten minutes of config prevents a category of vulnerability.

---

[View this post on daily.dev](https://daily.dev/posts/your-rest-api-is-probably-leaking-data-7-security-headers-you-re-missing-ksvxum6ad)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/your-rest-api-is-probably-leaking-data-7-security-headers-you-re-missing-ksvxum6ad","headline":"Your REST API Is Probably Leaking Data — 7 Security Headers You're Missing","text":"Discussion about \"Your REST API Is Probably Leaking Data — 7 Security Headers You're Missing\" on daily.dev - join the developer community","url":"https://daily.dev/posts/your-rest-api-is-probably-leaking-data-7-security-headers-you-re-missing-ksvxum6ad","datePublished":"2026-03-06T06:49:33.851Z","dateModified":"2026-03-06T06:49:33.851Z","author":{"@type":"Person","name":"sirajju","url":"https://daily.dev/sirajju","image":"https://media.daily.dev/image/upload/s--IbwvoTYq--/f_auto/v1772778404/avatars/avatar_giQfoBCN9hYxcvRVo3s95?_a=BAMAMiiu0","description":"Empty","worksFor":{"@type":"Organization","name":"Acodez","logo":"https://res.cloudinary.com/daily-now/image/upload/s--9-AnYpsB--/f_auto/v1725541842/companies/acodez"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":260}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"The CORS wildcard one always gets me. I’ve seen production APIs serving financial data with Access-Control-Allow-Origin: * because “it fixed the CORS error during development” and nobody changed it. Ten minutes of config prevents a category of vulnerability.","datePublished":"2026-03-06T06:49:36.977Z","url":"https://daily.dev/posts/kSvxUm6Ad#c-RnbENTCMp","author":{"@type":"Person","name":"sirajju","url":"https://daily.dev/sirajju","image":"https://media.daily.dev/image/upload/s--IbwvoTYq--/f_auto/v1772778404/avatars/avatar_giQfoBCN9hYxcvRVo3s95?_a=BAMAMiiu0"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/giqfobcn9hyxcvrvo3s95","name":"sirajju"}}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"sirajju","item":"https://daily.dev/sources/giqfobcn9hyxcvrvo3s95"},{"@type":"ListItem","position":3,"name":"Your REST API Is Probably Leaking Data — 7 Security Headers You're Missing"}]}
```