What are the main methods of protecting the service API?

Question

XSS

When developing an API for your web service, please tell me the main details that you should definitely take into account?
The first thing to worry about is:
- CORS
- DDOS
- XSS (SQL Injection, Cookie stealers, worms)
- Sniffer
- all sorts of loggers, etc., everything that allows a malicious person to get sensitive data.
Type functions:
htmlentities(), strip_tags(), utf8_decode() etc
As I understand it, CSRF can be thrown out, or?) I
use JWT for authorization

Answer 1

the key decides everything
, this does not apply, of course, to filtering the input