What does secure-by-default configuration mean, and how can you implement it in an API?

• A. Start with permissive defaults; require no opt-ins; disable TLS.
• B. Start with safe defaults, deny-by-default where possible, and require explicit opt-ins for risky features; enable secure headers and TLS.
• C. Always disable secure headers; rely on client security.
• D. Default to insecure features; only enable security on request.

Answer: (B)

Secure-by-default means starting from a safe, locked-down baseline and only exposing or enabling features if an explicit opt-in is provided. In an API this translates to reducing the attack surface from the outset: communications are protected by default, sensitive operations require proper authorization, and risky capabilities aren’t turned on unless you deliberately enable them.

To implement this, initialize the API with strong security as the default:

• Enforce encrypted traffic by default: require TLS for all endpoints, use HTTPS-only, and enable protections like HTTP Strict-Transport-Security to prevent downgrade to insecure connections.

• Enable security-focused headers automatically: set headers that mitigate common risks, such as preventing content-type sniffing, controlling framing, and restricting script access.

• Apply deny-by-default access: assume endpoints are not accessible until authentication and authorization rules permit them. Implement least-privilege access so users and services can do only what they’re explicitly allowed to do.

• Harden cookies and sessions: use Secure and HttpOnly flags, and apply appropriate SameSite settings to prevent cross-site cookie leakage.

• Validate inputs and protect against common threats: implement strict input validation, CSRF protection for state-changing requests, and robust rate limiting to curb abuse.

• Keep cross-origin access tight: configure CORS to only allow trusted origins and, unless needed, avoid sending credentials by default.

• Offer risky features as opt-ins: features that increase exposure—such as verbose logging, detailed error messages, large file uploads, or webhooks—should require explicit enablement and, ideally, additional safeguards.

In short, the best approach is to begin with a safe, deny-by-default stance and layer in secure headers and TLS, while requiring explicit opt-ins for anything that could introduce risk. The other options describe permissive or insecure defaults that undermine protection from the start.