It's my first time building and deploying a REST API with just the standard library. Are there any gotchas I should keep an eye out for regarding securing my REST API?
Here's the list of best practices in securing RESTful API.
Always Use HTTPS - Traffic must be encrypted
Never expose information on URLs - as this can be captured in web server logs, which makes them easily exploitable.
Adding Timestamp in Request - This will prevent very basic replay attacks from people who are trying to brute force your system
Input Parameter Validation - Put strong validation checks and reject the request immediately if validation fails.
Use Auditing and Logging - Any subject or entity can be audited
For more information, OWASP Provide a cheatsheet found here.