Prisma select as a data boundary for Node.js APIs
Treat Prisma model instances as internal data. Wrap user-facing reads with an explicit select allowlist and return plain DTOs to avoid leaking password hashes and tokens.
Loading…
ReadMeFeed / Community knowledge
#api-security
Real questions. Useful conversations. Find the people who know your stack.
prismaSeparating Secrets from Shared Collections in Insomnia with Local and Git‑Backed Vaults
Learn how to keep API credentials out of shared workspaces while still versioning your contracts. This guide shows the minimal design, trust boundaries, operational checks, and failure modes when using Insomnia’s local vault and Git‑backed remote vault.
vault
insomniaStabilizing Webhook Development with ngrok Reserved Domains and Edge Auth
Stop updating webhook URLs every time you restart your server. Learn how to use ngrok reserved domains and edge authentication to create a stable, secure local development environment.
ngrokChoosing Between Okta Org and Custom Authorization Servers for Your API
Learn why Okta’s Org Authorization Server can’t issue custom scopes and how a Custom Authorization Server gives you least‑privilege tokens with verifiable issuer and audience claims.
oktaStopping Payload Pollution with NestJS ValidationPipe
Learn how to use NestJS ValidationPipe to eliminate payload pollution and manual type checking using declarative DTOs and class-validator.
nestjsMoodle Web Services: Minimum Secure Machine-to-Machine Design
A practical architecture note for using Moodle Web Services securely: minimal protocols, a dedicated service user with least privilege, token handling, and operational checks to avoid privilege escalation.
moodleStopping Code Interception: Implementing OAuth 2.0 PKCE
Learn how OAuth 2.0 PKCE prevents authorization code injection attacks in public clients like mobile apps and SPAs by using dynamic cryptographic verifiers.
Stop Abusive GraphQL Queries Before They Run: Cost and Depth Limits in Practice
GraphQL clients control query shape, which means they control server cost. Depth limits and query cost analysis let you reject abusive queries before execution — here's how to implement and tune them.
graphqlSecuring REST APIs with Swagger: Implementing OAuth2 Authorization Code Flow
Implementing OAuth2 Authorization Code flow in Swagger is straightforward: declare the flow in the spec, configure Swagger UI, and add a stateless JWT validator. Follow the checklist to avoid common pitfalls and know when to redesign.
swagger
openapi
typescript