REST API for querying genomic sequence data with JWT authentication, role-based access control, and OWASP API Security Top 10 compliance.
| Control | Implementation |
|---|---|
| Authentication | JWT Bearer tokens (HS256, configurable expiry) |
| Authorization | RBAC — Admin / Lab Technician / Researcher |
| Input Validation | Pydantic v2 with DNA sequence whitelist (A/C/G/T/N) |
| Rate Limiting | 100 req/min global · 10 req/min on /auth/token |
| Audit Logging | All CRUD events logged — no PII stored |
| Security Headers | CSP · X-Frame-Options · Referrer-Policy · Permissions-Policy |
| Container Security | Non-root user · minimal base image (python:3.12-slim) |
git clone https://github.com/dparedes-sec/bio-api-secure
cd bio-api-secure
cp .env.example .env
# Set SECRET_KEY in .env
docker-compose up --buildAPI: http://localhost:8000 Docs: http://localhost:8000/docs
See OWASP_API_CHECKLIST.md for full coverage.
Daniel Paredes — Developer transitioning into AppSec & DevSecOps | Bioinformatics Security