A data transfer object (DTO) is a data structure that carries structured data between software layers or processes without carrying domain behavior. In API implementations, it limits each boundary to the data that layer needs, such as moving data between the API, business, and database layers. section 1.2.2
Use DTOs as part of secure data handling:
- Transfer only the required fields between the API layer, business layer, database layer, and other layers. section 1.2.2
- Validate and sanitize incoming and outgoing data regardless of its origin; DTOs support the pattern but do not replace validation. section 1.2.2 section 1.5
- Combine DTOs with parameterized database queries to address data-handling risks such as SQL injection. section 1.2.2
- Test every layer with unit, integration, and security-focused testing so the implementation behaves as intended. section 1.5
Figure 1.6 Security by design fits into every step of the API development cycle. It encourages us to approach design, implementation, testing, and operations from a security point of view.
Use the security-by-design cycle to place DTO decisions alongside design, implementation, testing, and operations. section 1.5
