How one API wrapper enforces five security gates in deliberate order

A developer building CogniPrep, an AI prep platform, shared how every API route is funnelled through a single wrapper that enforces five sequential security checks. The wrapper runs a global IP-based rate limit first, before any authentication, to block unauthenticated floods without incurring database costs. A CSRF token check follows next, placed ahead of the Supabase auth call because it requires no I/O and can cheaply reject invalid requests early. The article highlights how the order of these gates — not their individual logic — is the core design decision, with each position answering a specific security question. It also flags common implementation pitfalls, such as reading the leftmost IP from x-forwarded-for headers, which can be spoofed by clients to bypass rate limiting.