Security

Wappi provides comprehensive security features to protect your API and ensure secure communication between your frontend and backend applications.

Security Overview

Security in Wappi is built around multiple layers of protection:

• API Key Authentication - Secure your API endpoints with API keys
• JWT Authentication - Token-based authentication for user sessions
• Domain Whitelisting - Restrict API access to specific domains
• Request Validation - Validate all incoming requests and data
• Rate Limiting - Protect against abuse and DDoS attacks
• HTTPS Enforcement - Secure communication over encrypted connections

Built-in Security Features

Automatic Request Validation

Wappi automatically validates all incoming requests against your defined types and schemas:

1// Automatic validation based on endpoint types
2interface User_CreateUser_1_0_0__Body {
3  name: string
4  email: string
5  password: string
6}
7
8// Wappi automatically validates the request body
9// Invalid requests are rejected before reaching your endpoint

Domain Whitelisting

Configure allowed domains in your wappi.json configuration:

1{
2  "domains": "yourdomain.com, api.yourdomain.com, www.yourdomain.com",
3  "private": false
4}

Environment-based Security

Different security settings for different environments:

1# Development
2ENVIRONMENT=localhost
3SHOW_LOGS=true
4
5# Production
6ENVIRONMENT=prod
7SHOW_LOGS=false
8AUTH_KEY_CURRENT=your-production-key
9AUTH_KEY_PREVIOUS=your-previous-key

Security Best Practices

• Always use HTTPS in production environments
• Regularly rotate your API keys and JWT secrets
• Implement proper input validation and sanitization
• Use environment variables for sensitive configuration
• Enable logging for security events and monitoring
• Implement rate limiting to prevent abuse
• Keep your dependencies up to date
• Use strong, unique passwords and secrets

Security Headers

Wappi automatically sets important security headers:

1// Automatically set by Wappi
2{
3  "X-Content-Type-Options": "nosniff",
4  "X-Frame-Options": "DENY",
5  "X-XSS-Protection": "1; mode=block",
6  "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
7  "Content-Security-Policy": "default-src 'self'"
8}

Error Handling

Secure error handling prevents information leakage:

1// Production error response (no sensitive information)
2{
3  "success": false,
4  "message": "Authentication failed",
5  "statusCode": 401
6}
7
8// Development error response (detailed for debugging)
9{
10  "success": false,
11  "message": "JWT token expired at 2024-01-15T10:30:00Z",
12  "statusCode": 401,
13  "stack": "Error: JWT expired..."
14}

Next Steps

Explore the specific security features:

• API Keys - Learn about API key authentication
• JWT Authentication - Implement JWT-based user authentication