Securing Public GraphQL APIs with Persisted Query Allowlists
Stop arbitrary GraphQL execution on public endpoints by implementing a SHA-256 persisted query allowlist, separating public identity-based access from internal ad-hoc querying.
Loading…
ReadMeFeed / Community knowledge
#api-security
Real questions. Useful conversations. Find the people who know your stack.
Stopping Data Leaks and Boilerplate with Fastify Schema Validation
Stop writing repetitive validation logic. Learn how Fastify uses JSON Schema and fast-json-stringify to automate input validation and prevent accidental data leaks in your API responses.
fastifyProtect Your APIs with Cloudflare Rate Limiting: A Practical Guide
Cloudflare Rate Limiting lets you protect API endpoints at the edge. This guide shows how to configure thresholds, bursts, and custom responses, explains trade‑offs, and gives a step‑by‑step example to help you deploy the feature safely.
cloudflareSecuring Backend Services with Okta OAuth 2.0 Tokens: An Architecture Note
Secure a backend API with Okta by validating JWTs against the Authorization Server’s JWKS, enforcing issuer, audience, and custom scopes. Follow a minimal design that uses a single AS and RS, implement caching, monitor JWKS rotation, and be ready to switch to FGA or mTLS when needed.
oktaqTest Public Link defaults and token persistence during 11.0 migration
Project Access Control Transition qTest 11.0 (SaaS) introduced a default-deny posture for public links and new token rotation policies to prevent unauthorized access to test artifacts. However, the migration process from versions 9.x or 10.x to 11.0 does not automatically apply these restrictive defaults to existing project configurations. Security Gaps in L
qtestNotion API and Workspace Isolation: Managing Integration Tokens for Non-Production Testing
Notion provides Internal Integrations that generate secret tokens tied to specific workspaces. Because these tokens grant direct API access to any page shared with the integration, there is a risk of data corruption when using production credentials during the development of automation scripts. The current API architecture does not include a dedicated sandbo
DEFAULT_PERMISSION_CLASSES and per-view permission_classes override boundary
Goal is to define a permission configuration for Django REST Framework where no view is unintentionally publicly accessible. DRF’s documented default permission class is AllowAny, and a project-wide DEFAULT_PERMISSION_CLASSES setting in REST_FRAMEWORK can provide a baseline. Per-view permission_classes can override the global default, and the interaction bet
djangorestScalingo and GitHub Actions: Isolating Review App Provisioning from Production Credentials
Review App Automation and Scope Isolation Implementing a CI/CD pipeline using GitHub Actions to automate Scalingo Review Apps requires a balance between automation and security. To prevent the accidental modification of production resources, the integration should rely on a token with limited scopes rather than a full administrative account. The goal is to u
scalingoSpectral "Operation must define a security requirement" — should OpenAPI default to secure?
Spectral error: Operation must define a security requirement While linting an OpenAPI 3.0 document, Spectral's operation-security-defined rule reports Operation must define a security requirement for every operation that lacks an explicit security block when the document has no global security section. In OpenAPI 3.0, such operations inherit no security requ
openapi