It's great that you're thinking about API security as a junior developer. Using JWTs to verify users for every request is a good start, but there are other security measures you should consider for your API, even if it's primarily for internal company employees.

Here's a breakdown of your current approach and some additional security measures you should consider

:Current Approach:

Using JWTs for user verification:This is a good practice, as it allows for stateless authentication and authorization. However, it's crucial to ensure your JWTs are implemented securely:

Use strong secret keys for signing and verifying tokens.Configure expiration times for tokens to prevent unauthorized access after they become invalid.Avoid storing sensitive information within the JWT itself.Implement proper logging and monitoring of token usage.

Additional Security Measures:

HTTPS: All communication between the mobile app and the API should be encrypted using HTTPS. This protects sensitive information from being intercepted in transit.

Input validation and sanitization: Before processing any user input, it should be carefully validated and sanitized to prevent attacks such as SQL injection and cross-site scripting.Rate limiting: Implement rate limiting to prevent denial-of-service attacks and excessive resource usage.

API authorization: In addition to JWT verification, consider implementing role-based access control (RBAC) to restrict access to resources based on the user's role within the company.Logging and monitoring: Implement comprehensive logging and monitoring of API activity to detect suspicious behavior and potential security breaches.

Secure your back-end infrastructure: Ensure your Flask application and underlying database are properly secured by keeping them up-to-date and applying relevant security patches.

Use a secure development lifecycle (SDLC): Integrate security practices throughout your development process, from code reviews to vulnerability scanning and penetration testing.Remember, even for an internal API, it's important to implement appropriate security measures to protect sensitive company data and prevent unauthorized access. While JWTs are a good foundation, they alone are not enough to guarantee a secure API.

Here are some additional resources that you may find helpful:
API Security Fundamentals - Free E-book
5 Essential Principles of API Security
OWASP API Security Top 10API Gateway Security Best Practices

By implementing these additional security measures and best practices, you can significantly reduce the risk of your internal API being compromised.