Xano security checklist

Xano Security Best Practices

Xano provides the infrastructure for your app. You are responsible for setting up authentication, permissions, and the logic that protects your data.

We offer Xano security audits to check your application for security issues. These can include a WeWeb audit.

---

Security needs several checks

1. Identity Who is making the request?
2. Permissions May this person perform this action?
3. Data scope Which records may the request access?

1. Authentication

Authentication establishes who is making a request. A valid token is only the first check: the backend must still decide which actions and records that person may access.

• Don’t wait: Secure private endpoints from the start.
• How to set up: Require authentication on every private endpoint and test a request without a token. Xano’s authentication guide explains token creation and endpoint protection.

---

2. CORS Settings

CORS (Cross-Origin Resource Sharing) tells a browser whether a page may read a response from another origin. It is not API authentication and does not block every cross-origin request. MDN explains the distinction.

• Why it matters: Configure Access-Control-Allow-Origin for the frontends that may read browser responses. Other clients can still call the endpoint, so server-side authorization remains necessary.
• Note: CORS only affects browser-based requests. It does not restrict server-side calls (like a Xano-to-Xano request).
• How to set up: Go to your API Group -> More options -> CORS Management.

---

3. UUID vs. Integer ID

A randomly generated UUID (Universally Unique Identifier) is harder to guess than a sequential Integer ID.

• The Security Benefit: Sequential IDs are easy to enumerate. Random UUIDs make guessing harder, but neither format protects a record if the backend omits an ownership check. OWASP recommends authorization for every referenced object.
• Trade-offs:
  • Storage: A PostgreSQL UUID takes 16 bytes; integer storage depends on the chosen integer type.
  • Performance: For large tables (hundreds of millions of records), UUID indexes can be slightly slower.
  • Xano Storage: Larger indexes consume more of your “Database SSD Storage” quota.

---

4. Referencing User ID in API

For a self-service action such as editing your own profile, derive the target user from the authenticated context. Administrative actions that accept another user’s ID need a separate permission check.

• The Vulnerability: If your API trusts a caller-supplied user_id without authorization, a malicious user could change it to someone else’s ID and modify their data.
• The Fix: Always use auth.id (the ID embedded in the secure authentication token) to identify the user making the request.

---

Updating your own profile

1. 01 Authenticated request
2. 02 Read auth.id
3. 03 Select own record
4. 04 Apply allowed changes

5. Back-end Password Strength

Enforce password rules on the backend wherever passwords are set or changed. Support long passphrases and password managers, and reject commonly used or compromised passwords where your authentication setup supports that check. Mandatory symbol rules alone are not a substitute for length, rate limiting and multifactor authentication. See the OWASP authentication guidance.

---

6. Consistent Error Messages

According to OWASP (Open Web Application Security Project) recommendations, your login and password reset flows should not reveal whether a specific email address exists in your system.

• Bad Example: “Email not found” or “Incorrect password.” (Together these tell an attacker whether the email exists.)
• Good Example: “Invalid email or password.”

For a password-reset request, use a response such as “If an account exists, we will send reset instructions.” Keep status codes and response timing from revealing the same account information.

• Why: Generic messages reduce information available for “user enumeration,” where attackers test lists of emails to see who has an account on your platform.

---

What a login error reveals

	Specific account detail	Generic response
Message	Email not found / incorrect password	Invalid email or password
Information revealed	Whether an account exists	Only that the login failed

7. Access to Swagger Documentation

Xano automatically generates Swagger documentation (an interactive map of your API). Decide deliberately whether the API is public or internal. Restrict internal documentation where appropriate, but protect every endpoint even when its documentation is hidden.

• Configuration: You can restrict access to your Swagger documentation in the API Group Settings.

---

8. Role-Based Access Control (RBAC)

Apps with different user roles (e.g., Admin, Manager, User) need permission checks on each request.

Where permission checks belong

The frontend can hide unavailable actions for convenience. The backend must enforce the actual rule on every request.

Reading roles from the database gives the check current information. Xano token extras can carry claims such as a role or organization, which avoids repeating some lookups. But a token is a snapshot: changing a role in the database does not rewrite a token already issued. Cached permission results have a similar freshness problem.

Choose an expiry, refresh or invalidation strategy that matches how quickly access must be revoked. Scope caches to the user and organization, and check access to the requested record as well as the broad role.

Permissions need a way to change

Access rules

1. 1 Grant access
2. 2 Check each request
3. 3 Change or revoke
4. 4 Refresh or invalidate