https://www.illusionsofwisdom.com/securing-apis-best-practices-and-common-pitfalls/