Node.jsQuestion 19 of 26
Application security
Answer out loud or in your head first, then compare.
Answer
I start from the trust boundaries: I validate input, check the session and permissions on the server, and limit the data returned to the client.
- I use safe database queries and protect against injection.
- I use HTTPS, secure cookies and CSRF protection where the authentication model needs it.
- I control request sizes, rate limiting and login attempts.
- I keep secrets out of the repository and the logs.
- I update dependencies and log significant events.
Example: an order endpoint checks who owns the order instead of trusting a userId sent by the client.
Pitfall: CORS, JWT or any single library is not a whole security system.
How did it go? Be honest — “Not yet” puts the question on your review list.