REST API hardening: allow-list methods, content types and sizes

Decide which HTTP methods, content types and body sizes each endpoint accepts, and refuse everything else with the matching status code: 405, 415 or 413, depending on what is wrong. The OWASP REST Security Cheat Sheet recommends allow-lists for all three.

Methods

OWASP says to use an allow-list of permitted methods and return 405 Method Not Allowed for anything else. It also says to check authorization for each method on each resource.

That second part is the one that bites. OWASP's BFLA entry describes a user who changes a GET into a POST on an admin route that lacks checks and issues themselves an admin invite. The path was the same. The method was not.

• List the methods each route supports.
• Disable the rest, including methods you never use.
• Authorize per method, not per path.

Content types

For requests with bodies, the cheat sheet says to require a supported Content-Type and reject others with 415 Unsupported Media Type. It says not to copy the Accept header into Content-Type, and to return 406 Not Acceptable when no acceptable representation exists.

OWASP's security misconfiguration advice agrees: accept only the content types and data formats the business requires.

• Accept JSON where you use JSON. Do not leave XML parsing switched on by accident.
• If you must parse XML, the cheat sheet says to use parsers hardened against XXE.

Sizes and shape

• Enforce request size limits and return 413 Payload Too Large.
• Validate type, length, range and format of every field, and reject unexpected content.
• Log validation failures.

Size and shape limits double as resource controls. See the API resource limits checklist.

Response headers

The cheat sheet recommends including Cache-Control no-store, a Content-Type that matches the body, X-Content-Type-Options nosniff, Strict-Transport-Security and framing protections. Browser directed headers matter most if the API can return HTML.

Errors

Return generic error messages and never expose stack traces or internal details. OWASP's misconfiguration page also says to define and enforce response schemas, including error responses. See designing API error responses.

Consistency across the chain

OWASP also says every server in the HTTP chain, such as load balancers, proxies and back ends, should handle requests consistently, to avoid desync issues. Test the full path, not only your app.

The checklist

1. Method allow-list per route, 405 otherwise.
2. Authorization check per method.
3. Content-Type required and allow-listed, 415 otherwise.
4. Accept handled, 406 when nothing matches.
5. Body size limit, 413 otherwise.
6. Field validation and rejection of unknown content.
7. Security headers set.
8. Generic errors, schema for errors.
9. HTTPS only.

Quick check

Safeguard's policy gates can run checks in pull requests, and the free scan at gold.safeguard.sh/scan covers dependency issues in your framework.

Sources

• OWASP REST Security Cheat Sheet
• OWASP API8:2023 Security Misconfiguration
• OWASP API5:2023 Broken Function Level Authorization

Last reviewed: 19 October 2026.